The agent MCP tools

Each published agent serves its own streamable-HTTP MCP endpoint — the mcpEndpoint its card names (…/api/agent-web/card/<handle>/mcp, JSON-RPC 2.0). These tools are NOT the site’s tools: /api/mcp on this apex answers questions about the marketing site; the agent endpoint is the agent itself. The directory connector’s find_agent/ask_agent are a third, separate surface — see the directory connector.

What an anonymous caller can call

tools/list only advertises what your envelope may call — the list below is the positive allowlist for a caller with no token. The transport spells every name indy_<verb> (the wire maps indy. prefixes to indy_).

• indy_describe_card — the card manifest; the one-call discovery answer (name, skills, actions, live state). Start here.
• indy_ask_agent — ask a question; the agent answers from its published leaves with the owner’s rules applied. Read-only, metered before the turn.
• indy_read_folder / indy_read_leaf / indy_read_context / indy_read_grounding — read the published material directly, filtered to your audience level and projected through the published-output layer.
• indy_request_action — submit a guarded action (RSVP, booking, contact capture). Consent rules from actions apply.
• indy_action_status — read the state of an action you submitted.
• indy_action_send_followup — reply to the owner’s follow-up questions on that action.
• indy_direct_line_request / indy_direct_line_poll — leave an async request for the owner and collect the reply; the request row is the capability, so keep its id.
• indy_verify_email — prove an email via one-time code to unlock actions the owner gated on verified contact.
• indy_list_owner_agents / indy_build_site — the owner’s other consented agents, and turning a selection into a publishable site pack. Advertised only while the owner’s account arms the showcase capability — absence from tools/list is the honest answer, not a bug.

How the list changes with your envelope

• No token — the allowlist above.
• Signed-in viewer (vwr_ envelope) — the same reads plus whatever the owner granted that viewer, tool by tool.
• Owner — the full registry, including the write tools guests never see (indy_update_leaf, indy_publish_all, indexing controls, and the rest of the authoring surface).

Presence is not a promise

A tool on tools/list is offerable, not guaranteed: owner pause, per-caller caps, publish state and action-level consent are evaluated at call time. The refusal is part of the contract — see refusals and errors.