NylorunDocsBeta
Management APITool policy

Set the Tenant's tool policy

PUT
/v1/tenant/tool-policy

Replaces every rule. The Tool Gate applies them to each MCP and HTTP tool call of every harness, before it sends the call: the strictest rule that matches decides. deny refuses the call (the model gets tool.denied), ask holds it and pauses the turn until a person answers it with an approve command on the session, allow runs it. A call no rule matches runs. A rule matches when every selector it sets matches: tool (the tool's identity: an MCP tool's own name on its server, or an HTTP tool's declared name, never the name the model calls it by; * matches any run of characters), server (an MCP server's name), kind (mcp or http), agent (the agent that calls it: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id) and when (fields of the call's input by dotted path, each tested with equals, in, gt, gte, lt, lte or matches). A tool with __ in it, a model-facing server__tool name, is refused (400): name an MCP tool by server and tool. A stored policy with such a rule refuses every call until it is set again. Sandbox tools never cross the gate. An empty list allows every call.

Authorization

managementKey
headerAuthorizationBearer <token>

A management key of the Tenant (role management): it reaches the Management API (/v1/tenant/*) and /v1/me, as itself, never for a subject. Issued only on the Tenant's machine (nylorun-operate keys put <id> --role management) or from NYLORUN_MANAGEMENT_KEY_FILE. Never accepted from a browser (Origin).

Header Parameters

Nylorun-Protocol*string

The protocol version, 18

Request Body

application/json
  1. body
requestId?string
Length1 <= length
rules*array<>

Response Body

The policy now in force

application/json
  1. response
rules*array<>
updatedAt*string|null
import { createAdmin } from "@nylorun/admin";const admin = createAdmin();await admin.toolPolicy.put({  rules: [    { effect: "ask", agent: "support", tool: "refund_order", reason: "Refunds need a person" },    { effect: "deny", server: "github", tool: "github__delete_*" },  ],});
{  "rules": [    {      "effect": "allow",      "tool": "string",      "server": "string",      "kind": "mcp",      "agent": "string",      "when": {        "property1": {          "equals": "string",          "in": [            "string"          ],          "gt": 0,          "gte": 0,          "lt": 0,          "lte": 0,          "matches": "string"        },        "property2": {          "equals": "string",          "in": [            "string"          ],          "gt": 0,          "gte": 0,          "lt": 0,          "lte": 0,          "matches": "string"        }      },      "reason": "string"    }  ],  "updatedAt": "string"}

Get the Tenant's tool policy GET

Previous Page

Check an Agent's credentials POST

For each remote MCP server and each HTTP tool with a `credential` that Agent `agentId`'s manifest version declares (its own, its agents used as tools' and a flow's), the credential its sessions would send: the Agent's secret bound to the URL (`covered`), or none (`missing`). No secret is read and no server is called.