Loading…
Install a signed connector .tgz directly — handy for air-gapped environments. The bundle is always verified against the configured trust root before it is loaded.
RUNS_ON relation)IN_NAMESPACE edge (e.g. k8s namespaces, future: vCenter folders).
Configure how service health scores are calculated. Weights must sum to 1.0.
Each data source has its own metric definitions with backend-specific queries (PromQL, LogQL, etc.). Use {{service}} as placeholder for the service/job name.
| Name | Unit | Query | Description | |
|---|---|---|---|---|
| Select a source above | ||||
# grant the "viewer" role read-only metrics, bind a principal to it. # needs an admin API key (a principal the current policy grants admin). curl -X PUT http://localhost:3000/api/enterprise/policy \ -H "Authorization: Bearer <ADMIN_API_KEY>" \ -H "Content-Type: application/json" \ -d '{ "roles": { "viewer": { "tools": ["query_metrics","get_service_health"], "readOnly": true } }, "bindings": { "alice": ["viewer"] } }'
A curated, named bundle of MCP tools you expose to one agent. The bundle's tools allow-list filters tools/list at the /mcp transport, so an agent bound to Ops Bundle sees only the operations tools and not the developer tools.
Whenever more than one agent connects. Each team / use-case gets its own product — SRE on-call vs coding assistant vs compliance auditor. Without a product the credential sees every registered tool, which is fine for a single-operator demo but not for a production multi-agent deployment.
Bind a credential to a product via OMCP_KEY_PRODUCTS:
OMCP_API_KEYS="agent:tok_ops,ci:tok_dev"
OMCP_KEY_PRODUCTS="agent=ops-bundle;ci=dev-bundle"The next /mcp session of agent sees only the tools in ops-bundle. Full docs →
# publish a "payments-eu" product and grant it to a principal. # needs an admin API key (a principal the current policy grants admin). curl -X PUT http://localhost:3000/api/enterprise/catalog \ -H "Authorization: Bearer <ADMIN_API_KEY>" \ -H "Content-Type: application/json" \ -d '{ "products": { "payments-eu": { "description": "EU payment-service metrics + logs", "sources": ["prometheus","loki"], "services": ["payment-service"] } }, "grants": { "alice": ["payments-eu"] } }'
# issuer side — sign an entitlement token node enterprise/entitlement/mint.mjs \ --key issuer-ed25519.pem \ --sub org-acme --features access-control,audit --ttl 365d # deployment — current gate mode curl -s http://localhost:3000/api/enterprise/status