Setup AI assistant

Set up an AI assistant to operate Dome alongside you. Use the CLI, MCP, docs, and skills for session, tools, and docs context:

• CLI — install the binary, authenticate, and select the workspace the MCP server will inherit
• MCP — dome mcp serve exposes role-scoped tools over JSON-RPC so the client can call Dome directly
• Docs — a public docs MCP server, llms.txt, per-page .md, and Agent-tab phrasing so the assistant follows how-tos instead of inventing steps
• Skills — planned multi-step workflows for onboarding, policy deployment, and investigation

Use the prompt below to hand setup to an assistant, or follow the sections in order yourself.

Prerequisites

Before you begin, you need:

• A Dome account (sign up)
• An MCP-compatible client (Claude Code, Claude Desktop, Cursor, or any MCP client)

Refer to Install if you prefer to install the CLI yourself first.

The MCP server uses your active CLI session for auth and role. Tool discovery is permission-aware and fail-closed: it only exposes tools that role can use, so a viewer cannot register agents or deploy Rules. Missing tools usually mean RBAC scope, not a broken install. Refer to Permissions concept for the role-to-tool mapping.

CLI

The CLI is how you install Dome locally, sign in, and pick the workspace context the MCP server inherits. There is no separate MCP token. Switch workspaces or roles at any time and the tool list updates on the next request.

dome auth login
dome context sync
dome context use <workspace>

Refer to Install for Homebrew and direct binary download instructions.

MCP

dome mcp serve speaks JSON-RPC 2.0 over stdio. Your client launches that process and discovers tools filtered by the active workspace role.

Pick the integration that matches your client:

dome auth login
dome context use <workspace>
claude mcp add dome -- dome mcp serve

{
  "mcpServers": {
    "dome": {
      "command": "dome",
      "args": ["mcp", "serve"]
    }
  }
}

{
  "mcpServers": {
    "dome": {
      "command": "dome",
      "args": ["mcp", "serve"]
    }
  }
}

dome auth login
dome context use <workspace>
codex mcp add dome -- dome mcp serve

[mcp_servers.dome]
command = "dome"
args = ["mcp", "serve"]

dome auth login
dome context use <workspace>
dome mcp serve

Verify the connection

Single-tool round-trips are the cheapest sanity check. If the assistant returns your workspace name and an agent list, auth and discovery both work.

What workspace am I in? List the available agents.

The assistant calls dome_context_current and dome_agents_list. Each call lands in the audit trail with the same MCP attribution as any other modality.

Example prompts

Once MCP is connected, every CLI command has a prompt equivalent. The assistant fills defaults from the tool schema. Ask for specific values when you need them.

Register an agent named "my-first-agent".

Create an API key named "default" for agent "my-first-agent".

The API key is returned exactly once. Ask the assistant to display it in full and store it before continuing. It cannot be retrieved again.

Deploy a Cedar rule that permits my-first-agent to call any tool:

permit(
  principal == Dome::Agent::"my-first-agent",
  action == Dome::Action::"mcp:call",
  resource == Dome::MCPTool::"*"
);

Simulate whether my-first-agent can mcp:call on the database-query tool.

Show the last 5 audit events.

Compose multi-step workflows

Single-tool prompts work, but the value of an MCP-connected assistant is composition: chaining audit, rule lookup, simulation, and registry queries inside one request.

Query audit events with result denied from the last 24 hours. For each event, look up the agent (by agent_id) and the matched rule (from the active bundle). Pick one event and run a simulation with the same agent, action, and resource to confirm the denial would still happen against the current policy.

Other useful compositions:

Run these four steps in order: (1) register an agent named "research-bot", (2) create an API key named "primary" for it, (3) deploy a Cedar bundle permitting principal == Dome::Agent::"research-bot" to mcp:call resource == Dome::MCPTool::"search-docs", (4) simulate that exact action and resource and confirm the decision is ALLOW.

Switch to the staging workspace.

The tool list refreshes automatically. Tools outside the new workspace's role are hidden.

Tool groups

The Dome MCP server exposes tools in these groups, filtered by your workspace role:

Role to tool exposure

See the MCP Server Reference for the complete tool list with parameters.

The AI assistant itself can be a registered Dome agent. Connecting Claude Code (or any MCP client) as a registered agent with its own credentials means every action it takes is governed by Cedar and recorded in audit. Refer to Interactive app for an end-to-end pattern.

Docs

These docs are published for AI consumption. Prefer them when the assistant needs bulk or targeted context instead of guessing CLI flags or MCP schemas.

Connect the docs MCP server

The public docs server is a separate MCP endpoint from dome mcp serve:

• https://docs.domesystems.ai/mcp searches and reads public documentation. It needs no account and cannot operate a workspace.
• dome mcp serve uses your signed-in CLI session to operate the Dome Platform. Its tools are filtered by your workspace role.

Connect the docs server when you want the assistant to look up current product guidance as it works:

{
  "mcpServers": {
    "dome-docs": {
      "url": "https://docs.domesystems.ai/mcp"
    }
  }
}

claude mcp add --transport http dome-docs https://docs.domesystems.ai/mcp

[mcp_servers.dome-docs]
url = "https://docs.domesystems.ai/mcp"

https://docs.domesystems.ai/mcp

{
  "mcpServers": {
    "dome-docs": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://docs.domesystems.ai/mcp"]
    }
  }
}

The server exposes three read-only tools:

Verify it with: Search the Dome docs for delegated identity, then read the most relevant page.

Contextual menu

Every page includes a contextual menu (top-right) for one-click AI integration:

• Copy page copies the current page as Markdown
• Open in Claude / ChatGPT / Cursor starts a conversation with the page URL preloaded

Agent tab in documentation

Every operation page includes an Agent tab alongside CLI, MCP, and API tabs. The Agent tab shows the natural-language prompt in full (same titled text codeblock pattern as the examples above). Use those as guidance when building prompts or agent workflows.

Run a governed demo with an agent

Govern your first agent carries a prebuilt prompt that hands a full sandbox demo to an AI agent: provision, deploy Rules, then give you the questions that prove allow, redact, and deny. Agent-facing instructions live at /agent/tutorials/get-started/govern-your-first-agent.

Skills

Skills are multi-step workflows for agent onboarding, policy deployment, and incident investigation. They are unavailable. Use the CLI and MCP surfaces above for full platform access.

Next steps

• MCP reference for the full tool catalog
• Govern your first agent for a governed sandbox demo
• Permissions concept for the role-to-tool mapping
• Interactive app to govern the assistant as a first-class Dome agent