MCP Server Reference

Dome MCP tools for agents — permission-aware discovery across Connect, Govern, Operate, and Manage

The Dome MCP server exposes platform tools organized into groups. Tool discovery is permission-aware and fail-closed: for API-key and CLI sessions, Dome introspects the credential scope and hides tools the caller cannot invoke. You only see tools matching your permissions.

Setup

dome auth login
dome context use <workspace>
dome mcp serve

Connect a client

dome mcp serve speaks JSON-RPC 2.0 over stdio. Your client launches that process and discovers tools filtered by the active workspace role. Pick the integration that matches your client:

dome auth login
dome context use <workspace>
claude mcp add dome -- dome mcp serve

Restart or reload Claude Code if tools do not appear. Tools auto-discover.

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "dome": {
      "command": "dome",
      "args": ["mcp", "serve"]
    }
  }
}

Restart Claude Desktop to connect.

Add to your Cursor MCP configuration:

{
  "mcpServers": {
    "dome": {
      "command": "dome",
      "args": ["mcp", "serve"]
    }
  }
}

dome auth login
dome context use <workspace>
codex mcp add dome -- dome mcp serve

Codex stores this in ~/.codex/config.toml. You can also write it by hand:

[mcp_servers.dome]
command = "dome"
args = ["mcp", "serve"]

Confirm with codex mcp list, then type /mcp in a Codex session.

dome auth login
dome context use <workspace>
dome mcp serve

Any MCP-compatible client that launches a stdio process works.

Switch workspaces mid-session with dome_context_use — the tool list updates to reflect your new permissions.

Guided prompts

The MCP server ships three guided prompts that run end-to-end onboarding flows from your client. Invoke them with /dome:quickstart, /dome:tutorial, or /dome:adopt in Claude Code (other clients expose prompts through their own UI).

Quickstart

Role-aware first-time setup.

Tutorial

Guided governed-agent walkthrough.

Adopt

Brownfield onboarding — route an existing codebase's LLM traffic through the gateway with no code changes.

Tool Groups

Blueprints

Validate, compile, and assess local Agent and Workspace Blueprints without mutation.

Agents

Tools

Attach MCP servers, configure upstream authentication, and publish governed tools.

Models

Connect LLM providers, secure upstream credentials, and publish governed model endpoints.

Pools

Route and fail over LLM traffic across model connections.

Gateways

Group tools and models behind Gateways, grant agent access, and configure scoped runtime endpoints.

Rules

Control which tools and models each agent is allowed to use.

Guards

Inspect, redact, and constrain content on tool and model connections.

Quotas

Cap governed LLM spend across workspaces, agents, Gateways, pools, and models.

Audit

Query audit events by class, result, actor, resource, correlation, and payload.

Callers

Inspect or erase verified end users projected from workspace audit activity.

Webhooks

Subscribe to Dome events and deliver signed webhooks with retries and replay.

Billing

Inspect plans and invoices, change seats, and manage subscription state.

Platform

Check platform status, manage scoped API keys, read configuration, and create tenants.

Workspaces

Create workspaces, manage members, and configure act-as enforcement and policy freshness.

Verification

Configure OIDC and HMAC providers that verify act-as identity for delegated agents.

Context

Switch org, tenant, and workspace sessions and check authentication status.

Permission Model

After selecting a context with dome_context_use, tools are filtered based on your workspace, tenant, and org roles. Higher-scope roles cascade into the tools visible inside a workspace context (an org owner sees every workspace tool).

Role	Access
admin	Every workspace tool — agents, gateway, rules, audit, members, API keys, configuration
operator	Agents, gateway, rules (deploy and rollback), audit (view, no export), API keys, configuration
security	Rules (deploy, rollback, simulate), audit (view and export), agent suspend, gateway view
developer	Agents, agent keys, rules view, audit view, gateway view
viewer	Read-only queries and listings

A handful of tools are gated only by an active context (no role requirement) — refer to Context and the platform tools dome_status_get, dome_config_get, dome_workspaces_list, dome_workspaces_get, dome_platform_keys_available_permissions. Tenant-level tools like dome_workspaces_create and dome_provision_sandbox require a tenant role; the tenant management tools dome_tenants_list, dome_tenants_get, and dome_tenants_create require an org role.

Context management tools are always available regardless of role. You do not need workspace context to list or switch contexts.

Tool Documentation Standard

Each MCP tool page documents:

Tool name — the exact dome_* identifier used in JSON-RPC calls
Parameters — typed parameter table with required/optional markers
Description — one-line purpose
Permission — a key callout naming the RBAC permission(s) the tool requires
Destructive flag — noted in the permission callout when the tool modifies or deletes data

Tools follow the MCP specification for tool discovery and invocation. The server returns tool schemas via tools/list that MCP clients use for auto-discovery.

Next steps

Connect a client, then start with Agents or Rules:

Setup AI assistant to connect Claude Code, Cursor, Codex, or another client
Agents for the first tool group most operators use
Rules to draft and deploy Cedar from an assistant
Quickstart to verify governed traffic end to end