> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP Server Reference

> Complete reference for the Dome MCP tools available to AI agents

The Dome MCP server exposes platform tools organized into groups. Tools are filtered based on your workspace, tenant, and org roles — you only see tools matching your permissions.

## Setup

```bash theme={"system"}
dome auth login
dome context use <workspace>
dome mcp serve
```

### Claude Integration

Register the Dome MCP server with Claude Code:

```bash theme={"system"}
claude mcp add dome -- dome mcp serve
```

Claude discovers available tools automatically. Switch workspaces mid-session with `dome_context_use` — the tool list updates to reflect your new permissions.

## Guided prompts

The MCP server ships three guided prompts that run end-to-end onboarding flows from your client. Invoke them with `/dome:quickstart`, `/dome:tutorial`, or `/dome:adopt` in Claude Code (other clients expose prompts through their own UI).

<CardGroup cols={3}>
  <Card title="Quickstart" href="/reference/mcp/prompts#quickstart">
    Role-aware first-time setup.
  </Card>

  <Card title="Tutorial" href="/reference/mcp/prompts#tutorial">
    Guided governed-agent walkthrough.
  </Card>

  <Card title="Adopt" href="/reference/mcp/prompts#adopt">
    Brownfield onboarding — route an existing codebase's LLM traffic through the gateway with no code changes.
  </Card>
</CardGroup>

## Tool Groups

<CardGroup cols={2}>
  <Card title="Context Management" href="/reference/mcp/context">
    9 tools — switch workspaces, manage aliases, check auth status. Always available.
  </Card>

  <Card title="Agent Registry" href="/reference/mcp/agents">
    13 tools — register agents, manage lifecycle, create and rotate API keys.
  </Card>

  <Card title="Authorization Rules" href="/reference/mcp/rules">
    10 tools — deploy Cedar rules, simulate decisions, rollback bundles.
  </Card>

  <Card title="Audit" href="/reference/mcp/audit">
    4 tools — query, inspect, and export audit events, and report LLM token usage and cost.
  </Card>

  <Card title="Webhooks" href="/reference/mcp/webhooks">
    14 tools — manage event subscriptions, inspect and replay deliveries, browse the provider catalog.
  </Card>

  <Card title="Platform Management" href="/reference/mcp/platform">
    7 tools — platform status, API keys (list, create, revoke, available permissions), configuration, tenant creation.
  </Card>

  <Card title="Workspaces" href="/reference/mcp/workspaces">
    11 tools — create workspaces, manage members, configure act-as enforcement and policy freshness, provision sandboxes.
  </Card>

  <Card title="Tools" href="/reference/mcp/tools">
    MCP server connection CRUD, catalog discovery, and shared-OAuth connect/disconnect.
  </Card>

  <Card title="Gateways" href="/reference/mcp/gateway">
    24 tools — create Gateways, curate membership, grant agent access, set cost caps.
  </Card>

  <Card title="LLM Models" href="/reference/mcp/models">
    LLM model connections and routing pools across Anthropic, OpenAI, Azure, Google, and Bedrock.
  </Card>

  <Card title="Verification Providers" href="/reference/mcp/verification">
    3 tools — manage OIDC and HMAC verification providers.
  </Card>
</CardGroup>

## Permission Model

After selecting a context with `dome_context_use`, tools are filtered based on your workspace, tenant, and org roles. Higher-scope roles cascade into the tools visible inside a workspace context (an org owner sees every workspace tool).

| Role          | Access                                                                                         |
| ------------- | ---------------------------------------------------------------------------------------------- |
| **admin**     | Every workspace tool — agents, gateway, rules, audit, members, API keys, configuration         |
| **operator**  | Agents, gateway, rules (deploy and rollback), audit (view, no export), API keys, configuration |
| **security**  | Rules (deploy, rollback, simulate), audit (view and export), agent suspend, gateway view       |
| **developer** | Agents, agent keys, rules view, audit view, gateway view                                       |
| **viewer**    | Read-only queries and listings                                                                 |

A handful of tools are gated only by an active context (no role requirement) — refer to [Context](/reference/mcp/context) and the platform tools `dome_status_get`, `dome_config_get`, `dome_workspaces_list`, `dome_workspaces_get`, `dome_platform_keys_available_permissions`. Tenant-level tools like `dome_workspaces_create` and `dome_provision_sandbox` require a tenant role; the tenant management tools `dome_tenants_list`, `dome_tenants_get`, and `dome_tenants_create` require an org role.

<Info>
  Context management tools are always available regardless of role. You do not need workspace context to list or switch contexts.
</Info>

## Tool Documentation Standard

Each MCP tool page documents:

* **Tool name** — the exact `dome_*` identifier used in JSON-RPC calls
* **Parameters** — typed parameter table with required/optional markers
* **Description** — one-line purpose
* **Permission** — which RBAC role(s) can access the tool
* **Destructive flag** — whether the tool modifies or deletes data

Tools follow the [MCP specification](https://modelcontextprotocol.io/) for tool discovery and invocation. The server returns tool schemas via `tools/list` that MCP clients use for auto-discovery.

## Next steps

Connect a client, then start with Agents or Rules:

* [Setup AI assistant](/setup-ai-assistant) to connect Claude or another client
* [Agents](/reference/mcp/agents) for the first tool group most operators use
* [Rules](/reference/mcp/rules) to draft and deploy Cedar from an assistant
* [Quickstart](/quickstart) to verify governed traffic end to end