Security model

  • Never accepts agency_id from the LLM, uses the trusted session header from the calling Node bridge.
  • Writes stage as pending actions; the floating chat widget shows an Approve / Cancel card. Approve re-verifies the session agency matches before applying.
  • No delete operations. By design.

Usage from the floating widget

Create a new agent called RenewalsBot with model claude-sonnet-4-6, give it access to agent-vault.

→ admin_agent_create stage → confirm card → approve → live.

Tools

  • admin_list_agents: List your agency's agents.
  • admin_get_agent: Get one agent's config + files.
  • admin_list_teams: List your agency's teams.
  • admin_get_team: Get one team's config + files.
  • admin_list_skills: List user + project skills available.
  • admin_list_mcps: List configured MCP servers.
  • admin_list_sequences: List scheduled routines.
  • admin_agent_create: Stage create-agent.
  • admin_agent_update: Stage update-agent.
  • admin_team_create: Stage create-team.
  • admin_team_update: Stage update-team.
  • admin_skill_create: Stage create-skill.
  • admin_skill_update: Stage update-skill.
  • admin_mcp_add: Stage add-MCP-server.
  • admin_mcp_update: Stage update-MCP-server.
  • admin_sequence_create: Stage create-routine.
  • admin_sequence_update: Stage update-routine.