# Set up Report Cloud Spend

This is a read-only composite, but it needs a model credential and every listed data source configured before it can run. Set up isolated test accounts or workspaces first, grant only the smallest read scope that exposes the test data, and store every credential only in Dome's secret inputs. Never put a key or secret in this repository, an agent prompt, or a chat message.

## Create the model credential

- Create an API key in the [Anthropic Console](https://console.anthropic.com/settings/keys).
- Enter the raw key as `anthropic_api_key` during import. Do not prepend `Bearer `.
- The template uses that key only for its managed `claude-sonnet-5` model connection.

## Create the provider credentials

- `digitalocean_bearer_token`: A DigitalOcean Personal Access Token with the `Bearer ` prefix
- `neon_bearer_token`: A Neon API key

For a provider that asks you to register a manual OAuth app, use this callback URL exactly:

`https://api.domesystems.ai/oauth/callback`

## Set up each connected provider

### DigitalOcean

Before import, open [DigitalOcean API tokens](https://cloud.digitalocean.com/account/api/tokens), create a dedicated Personal Access Token for the isolated test account, and copy it once. Select the smallest scope and expiry that can inspect the chosen resources; do not reuse a token that can deploy, scale, restart, or delete infrastructure.

- `digitalocean_bearer_token`: enter `Bearer ` followed by a DigitalOcean Personal Access Token. Use a dedicated token with the smallest permissions needed for the resources this agent will inspect.

The template sends that credential to DigitalOcean's MCP Router and discovers the App Platform tools this agent uses. Keep the token dedicated to this agent and do not use one that can deploy, scale, restart, or delete infrastructure.

### Neon

- `neon_bearer_token`: enter `Bearer ` followed by a Neon API key for the Neon account or organization the agent will inspect.

This composite uses Neon API-key authentication rather than OAuth, so it does not open a browser or require a callback URL. Create a dedicated Neon API key with only the access needed for the test account, then store it in Dome with the `Bearer ` prefix. Neon documents this API-key connection method in its [MCP client guide](https://neon.com/docs/ai/connect-mcp-clients-to-neon).

The MCP URL is pinned to read-only mode; do not remove that restriction in this composite. The agent's instructions also prohibit project, branch, schema, role, data, and compute changes.

### Supabase

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

This composite uses the hosted Supabase MCP server's browser OAuth flow with
Dynamic Client Registration. It does **not** need a Supabase OAuth client ID,
client secret, or manually registered callback URL.

- Import the template, then select **Connect** on the Supabase tool connection.
- Sign in with a least-privileged user that can access only an isolated,
  non-production test project.
- Confirm that the authorization is for the intended project before accepting
  the browser consent screen.
- The authorization requests read-only organization, project, database,
  analytics, Edge Function, environment, and Storage access. It does not
  request `secrets:read` or any write scope.
- Refresh the tool catalog after the connection succeeds, then run one
  read-only test against known non-production data.

The endpoint includes `read_only=true`; do not connect sensitive production
data without a separate review. The upstream server's available tools and
project access are still determined by the authorized Supabase identity.

### Netlify

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

After saving, authorize a test user restricted to the intended team and non-production sites. Do not use an identity allowed to modify deploys, environment variables, domains, or site configuration.

### Datadog

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

Before starting OAuth, a Datadog organization administrator must open
**Organization Settings → MCP OAuth Redirect URLs** and add this exact URL:

`https://api.domesystems.ai/oauth/callback`

Datadog rejects the consent flow with **Mismatching redirect URI** until that
allowlist entry exists. Dome uses Dynamic Client Registration, so no separate
Datadog OAuth client or client secret is needed. Dome requests Datadog's
published `mcp_all` scope during consent.

Before connecting, an organization administrator must also enable **MCP Access**
in Datadog. The authorizing test user needs **MCP Read** and the underlying
resource permissions (for example, Monitors Read); custom roles need those
permissions added explicitly. This composite starts with Datadog's generally
available `core` toolset. Add the Preview `apm` toolset only after obtaining
Datadog's APM Preview access.


After saving, complete OAuth with a test user that has read access only to the selected services, logs, and dashboards. This composite targets US1 and uses the `core` toolset.

### Sentry

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

After saving, complete OAuth with a test user that can view only the target organization and projects. Use project-scoped Sentry access wherever available.

## Import and verify

1. Import the template and provide the values above.
2. Complete every browser OAuth flow with the intended dedicated test user. Token-based sources do not open a browser.
3. Open **Tools**, refresh discovery, and confirm every connection is attached to the template gateway.
4. Run the managed agent against known test data. Treat the template as verified only when the run succeeds **and calls at least one expected read-only tool**.

If a connection is unreachable, check the provider section above for its callback, API/MCP enablement, token prefix, consent scopes, and user/workspace access before retrying.