Setup AI assistant

Set up an AI assistant to operate Dome alongside you. Use the CLI, MCP, docs, and skills for session, tools, and docs context:

CLI — install the binary, authenticate, and select the workspace the MCP server will inherit
MCP — dome mcp serve exposes role-scoped tools over JSON-RPC so the client can call Dome directly
Docs — llms.txt, per-page .md, and Agent-tab phrasing so the assistant follows how-tos instead of inventing steps
Skills — planned multi-step workflows for onboarding, policy deployment, and investigation

Use the prompt below to hand setup to an assistant, or follow the sections in order yourself.

Hand this to an AI agent. It installs the CLI if needed, connects MCP, verifies the session, and shows how it will use the Dome docs.

Open in Cursor

Prerequisites

Before you begin, you need:

An invitation-provisioned Dome account
An MCP-compatible client (Claude Code, Claude Desktop, Cursor, or any MCP client)

Refer to Install if you prefer to install the CLI yourself first. The MCP server uses your active CLI session for auth and role. It only exposes tools that role can use, so a viewer cannot register agents or deploy Rules. Refer to Permissions concept for the role-to-tool mapping.

CLI

The CLI is how you install Dome locally, sign in, and pick the workspace context the MCP server inherits. There is no separate MCP token. Switch workspaces or roles at any time and the tool list updates on the next request.

dome auth login
dome context sync
dome context use <workspace>

Full install options are on Install.

MCP

dome mcp serve speaks JSON-RPC 2.0 over stdio. Your client launches that process and discovers tools filtered by the active workspace role. Pick the integration that matches your client:

Claude Code
Claude Desktop
Cursor
Other MCP Client

dome auth login
dome context use <workspace>
claude mcp add dome -- dome mcp serve

Restart or reload Claude Code if tools do not appear. Tools auto-discover.

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "dome": {
      "command": "dome",
      "args": ["mcp", "serve"]
    }
  }
}

Restart Claude Desktop to connect.

Add to your Cursor MCP configuration:

{
  "mcpServers": {
    "dome": {
      "command": "dome",
      "args": ["mcp", "serve"]
    }
  }
}

Start the server on stdio:

dome auth login
dome mcp serve

Point your MCP client at stdin/stdout. Any MCP-compatible client works.

Verify the connection

Single-tool round-trips are the cheapest sanity check. If the assistant returns your workspace name and an agent list, auth and discovery both work.

Verify MCP connection

What workspace am I in? List the available agents.

The assistant calls dome_context_current and dome_agents_list. Each call lands in the audit trail with the same MCP attribution as any other modality.

Example prompts

Once MCP is connected, every CLI command has a prompt equivalent. The assistant fills defaults from the tool schema. Ask for specific values when you need them.

Register an agent named "my-first-agent".

Create an API key

Create an API key named "default" for agent "my-first-agent".

The API key is returned exactly once. Ask the assistant to display it in full and store it before continuing. It cannot be retrieved again.

Deploy a Cedar rule

Deploy a Cedar rule that permits my-first-agent to call any tool:

permit(
  principal == Dome::Agent::"my-first-agent",
  action == Dome::Action::"mcp:call",
  resource == Dome::MCPTool::"*"
);

Simulate an authorization decision

Simulate whether my-first-agent can mcp:call on the database-query tool.

Query recent audit

Show the last 5 audit events.

Compose multi-step workflows

Single-tool prompts work, but the value of an MCP-connected assistant is composition: chaining audit, rule lookup, simulation, and registry queries inside one request.

Investigate denied requests

Query audit events of type access.denied from the last 24 hours. For each event, look up the agent (by agent_id) and the matched rule (from the active bundle). Pick one event and run a simulation with the same agent, action, and resource to confirm the denial would still happen against the current policy.

Other useful compositions:

Onboard a new agent end-to-end

Run these four steps in order: (1) register an agent named "research-bot", (2) create an API key named "primary" for it, (3) deploy a Cedar bundle permitting principal == Dome::Agent::"research-bot" to mcp:call resource == Dome::MCPTool::"search-docs", (4) simulate that exact action and resource and confirm the decision is ALLOW.

Switch workspaces

Switch to the staging workspace.

The tool list refreshes automatically. Tools outside the new workspace’s role are hidden.

Tool groups

The Dome MCP server exposes tools in these groups, filtered by your workspace role:

Group	Description
Context	Switch workspaces, manage aliases, check auth status
Agents	Register, update, suspend, revoke agents and API keys
Rules	Deploy, validate, simulate, rollback Cedar policies
Audit	Query, inspect, export audit events
Platform	Platform status, API keys, configuration
Workspaces	Create workspaces, manage members, configure act-as
Tools	MCP server connections, catalogs, and managed authentication
Gateways	Group tools and models behind named endpoints, grant agent access, set cost caps
Verification	OIDC and HMAC verification providers

Role to tool exposure

Role	Tools available
admin	Every workspace tool: agents, gateway, rules, audit, members, configuration
operator	Agents, gateway, rules (deploy and rollback), audit (view, no export), API keys, configuration
security	Rules (deploy, rollback, simulate), audit (view and export), agent suspend, gateway view
developer	Agents, agent keys, rules view, audit view, gateway view
viewer	Read-only queries and listings

See the MCP Server Reference for the complete tool list with parameters. The AI assistant itself can be a registered Dome agent. Connecting Claude Code (or any MCP client) as a registered agent with its own credentials means every action it takes is governed by Cedar and recorded in audit. Refer to Code Execution Agent for an end-to-end pattern.

Docs

These docs are published for AI consumption. Prefer them when the assistant needs bulk or targeted context instead of guessing CLI flags or MCP schemas.

Format	URL	Use case
llms.txt	`/llms.txt`	Index of pages with titles and URLs
Full text	`/llms-full.txt`	Complete documentation as plain text
Per-page markdown	Append `.md` to any docs URL	Targeted context injection
Agent setup instructions	`/agent/setup-ai-assistant.md`	Confirm-first CLI + MCP setup this page hands to an assistant

Every page includes a contextual menu (top-right) for one-click AI integration:

Copy page copies the current page as Markdown
Open in Claude / ChatGPT starts a conversation with the page preloaded
Connect to Cursor / VS Code installs this documentation’s hosted MCP server so the assistant can search the docs directly

Agent tab in documentation

Every operation page includes an Agent tab alongside CLI, MCP, and API tabs. The Agent tab shows the natural-language prompt in full (same titled text codeblock pattern as the examples above). Use those as guidance when building prompts or agent workflows.

Run a governed demo with an agent

Govern your first agent carries a prebuilt prompt that hands a full sandbox demo to an AI agent: provision, deploy Rules, then give you the questions that prove allow, redact, and deny. Agent-facing instructions live at /agent/tutorials/get-started/govern-your-first-agent.

Skills

Skills are multi-step workflows for agent onboarding, policy deployment, and incident investigation. They are unavailable. Use the CLI and MCP surfaces above for full platform access.

Next steps

MCP reference for the full tool catalog
Govern your first agent for a governed sandbox demo
Permissions concept for the role-to-tool mapping
Code Execution Agent to govern the assistant as a first-class Dome agent

Get started

Core concepts

Connect

Govern

Operate

Manage

Develop

Reference

Setup AI assistant

Prerequisites

CLI

MCP

Verify the connection

Example prompts

Compose multi-step workflows

Tool groups

Role to tool exposure

Docs

Contextual menu

Agent tab in documentation

Run a governed demo with an agent

Skills

Next steps

​Prerequisites

​CLI

​MCP

​Verify the connection

​Example prompts

​Compose multi-step workflows

​Tool groups

​Role to tool exposure

​Docs

​Contextual menu

​Agent tab in documentation

​Run a governed demo with an agent

​Skills

​Next steps

Prerequisites

CLI

MCP

Verify the connection

Example prompts

Compose multi-step workflows

Tool groups

Role to tool exposure

Docs

Contextual menu

Agent tab in documentation

Run a governed demo with an agent

Skills

Next steps