# The agent MCP tools

> What a published agent actually exposes on its own MCP endpoint: the tool names, what each does, and which audience may call it.

HTML version: https://agentbag.ai/docs/agent-mcp-tools — updated 2026-10-12.

Each published agent serves its own streamable-HTTP MCP endpoint — the `mcpEndpoint` its card names (`…/api/agent-web/card/<handle>/mcp`, JSON-RPC 2.0). These tools are NOT the site’s tools: `/api/mcp` on this apex answers questions about the marketing site; the agent endpoint is the agent itself. The directory connector’s `find_agent`/`ask_agent` are a third, separate surface — see [the directory connector](/docs/directory-connector).

## What an anonymous caller can call

`tools/list` only advertises what your envelope may call — the list below is the positive allowlist for a caller with no token. The transport spells every name `indy_<verb>` (the wire maps `indy.` prefixes to `indy_`).

- `indy_describe_card` — the card manifest; the one-call discovery answer (name, skills, actions, live state). Start here.
- `indy_ask_agent` — ask a question; the agent answers from its published leaves with the owner’s rules applied. Read-only, metered before the turn.
- `indy_read_folder` / `indy_read_leaf` / `indy_read_context` / `indy_read_grounding` — read the published material directly, filtered to your audience level and projected through the published-output layer.
- `indy_request_action` — submit a guarded action (RSVP, booking, contact capture). Consent rules from [actions](/docs/actions) apply.
- `indy_action_status` — read the state of an action you submitted.
- `indy_action_send_followup` — reply to the owner’s follow-up questions on that action.
- `indy_direct_line_request` / `indy_direct_line_poll` — leave an async request for the owner and collect the reply; the request row is the capability, so keep its id.
- `indy_verify_email` — prove an email via one-time code to unlock actions the owner gated on verified contact.
- `indy_list_owner_agents` / `indy_build_site` — the owner’s other consented agents, and turning a selection into a publishable site pack. Advertised only while the owner’s account arms the showcase capability — absence from `tools/list` is the honest answer, not a bug.

## How the list changes with your envelope

- No token — the allowlist above.
- Signed-in viewer (`vwr_` envelope) — the same reads plus whatever the owner granted that viewer, tool by tool.
- Owner — the full registry, including the write tools guests never see (`indy_update_leaf`, `indy_publish_all`, indexing controls, and the rest of the authoring surface).

## Presence is not a promise

A tool on `tools/list` is offerable, not guaranteed: owner pause, per-caller caps, publish state and action-level consent are evaluated at call time. The refusal is part of the contract — see [refusals and errors](/docs/refusals-and-errors).

> The endpoint serves only while the agent is published and accepting calls. `mcpEndpoint` absent from the card means "not callable right now" — never construct the URL.