AgentPass Policy Builder

Build From MCP

Paste or upload a `tools/list` response, then create a starter policy in one step. Remote server fetch works when this builder is served locally.

MCP server URL Authorization headers

For authenticated remote MCP servers, run `agentpass config-ui --serve` and open the localhost URL so credentials stay on your machine.

Name the agent and choose the starting source for its authority policy.

ID Name Owner Environment Expires at Default JIT TTL

Purpose

Define how callers prove tenant, user, and agent identity before any tool execution.

Require OIDC tokens Token validation Issuer Audience JWKS URI Tenant claim

Constrain where this agent can operate: approved jobs, cases, customers, and data movement.

Require job boundary Require job_id Allowed jobs Out of scope Bind fields

Job boundaries prevent scope drift when a tool is allowed in general but not for this case or customer.

Set the downstream MCP server context used by generated gateway mappings.

Include MCP gateway mapping Mode Provider Downstream server

The generated mapping derives AgentPass fields from MCP tool arguments such as job_id, case_id, and customer_id.

Paste or upload `tools/list`, review inferred defaults, then apply selected tools into the policy.

MCP import suggests policy defaults from tool names, descriptions, and input schemas. Review before applying; the manifest remains authoritative.

Control whether this agent can hand work to another agent and which downstream tools remain in bounds.

May call agents Require approval Allowed agents Delegated tools Max depth Approval agents

Decide which tools are allowed, which require approval/JIT, and which should be blocked.

Skills declare the tools they may invoke. The skill contract is a requested authority envelope; the manifest decides what is allowed.

Turn on enforcement, drift detection, audit logging, and emergency revoke behavior.

Review the policy summary, then copy the manifest, OPA starter policy, or gateway request from the output panel.

Use the tabs below to copy the generated manifest, starter OPA policy, or gateway request example.