Agents, MCP tools and LexiGuard

Use the Agents and MCP native page to see which agent capabilities are available, inspect the machine-to-machine tool catalog, configure operation permissions and review guarded changes. The Panel enforces authentication and the guard; a connected client cannot approve its own request.

The current Agent status deliberately reports policy_and_guard_only. The existing authenticated MCP transport is available, but this does not mean there is an autonomous coding, workspace or general research executor. The machine protocol remains separate from the browser interface.

Open the pages

Go to Status and permissions at /rust/agents. Check Agent status and the current Agent permissions table.
Open MCP tool catalog at /rust/agents/tools. Expand any entry under Available tools to read its argument schema, server-classified effect and operation. The catalog is retrieved through GET /api/mcp/tools.
Administrators can select Tool, provide Arguments (JSON object) and check I understand and confirm this guarded action, then press Try guarded tool. The server calls POST /api/mcp/call with the existing authenticated, audited tool owner. A call can run, be refused or require a separate approval depending on current policy.
Visit Agent approvals at /rust/guard. Read Waiting for you, Recent decisions and How it works. For a pending request, explicitly check Confirm this decision before Approve or Deny. Only a signed-in administrator making a same-origin browser request can decide. An approved client repeats the same call with the same arguments before its approval expires; it is not automatically replayed by the Panel.
Use Save permission on /rust/agents to change a single operation to allow, ask or deny. Confirm the action and review the affected operation scope.

There are no separate tool-execution permissions for individual catalog entries. Allow applies to every tool assigned to the operation, subject to the guard's higher safety restrictions. Deleting files or directories cannot be automatic, and formatting disks is permanently denied to the agent policy. Privileged actions still require case-by-case review. Changes to permissions invalidate earlier approvals.

Guided task: Connect an MCP client and allow an operation

Open Guided connection at /rust/agents/connect and follow Connect an MCP client. Set up a Panel account and appropriately scoped credentials in Access and credentials at /rust/access.
Configure the client for the Panel's authenticated POST /api/mcp endpoint. For direct tool inventory requests, GET /api/mcp/tools returns the catalog; direct guarded calls use POST /api/mcp/call with name and arguments. Authentication and route scope still apply.
Under Guided permission preview, choose Tool and select Review permission scope. The Review all affected tools section shows the actual operation, current decision and every catalog entry sharing that permission.
Where the operation permits it, check I understand and confirm this guarded action, then press Allow shared operation. This commits the permission using POST /api/agent/permissions. If another change occurred since the preview, the form refuses and requires a new review.
Return to MCP tool catalog, use Try guarded tool with a valid JSON object, and check the result. If the guard requests manual review, open Agent approvals, inspect its arguments and approve or deny the pending call there. This does not guarantee that every operation will execute successfully: authorization, input validation and runtime conditions still apply.
For the Connect an MCP client and allow a tool operation guided task, enter Reviewed operation, Permission to apply and Previous permission as shown by the live scope preview. The guided apply writes through POST /api/ux/agents/conditional-permission only if the current policy still matches Previous permission. The guided undo restores the previous decision only when the current decision still matches the one just applied. A conflicting intervening change refuses the undo and requires manual review. The interactive Restore previous permission control is still available separately and also checks for a conflicting change.

The guided task is deliberately administrator-only. Viewing the catalog does not grant authority. A viewer cannot use the permission or trial-call forms. An administrator's browser session is required for these actions; the API remains subject to its existing credential and route-scope checks.

Control reference

The question-mark help markers beside controls show these exact descriptions.

Control	Tooltip
Agent status	Shows whether agent execution is supported and which authenticated transport is available.
Agent permissions	Shows allow, ask or deny for each operation; permissions do not replace authentication.
Save permission	Changes one operation policy for every tool in that operation and invalidates earlier approvals.
MCP tool catalog	Lists the authenticated protocol's available tools and their required argument shapes.
Try a tool	Runs the selected call through the existing authenticated guard; changing actions may need approval.
Connect an MCP client	Explains the protocol endpoint, credential scope and approval steps without exposing secrets.
Preview tool permission scope	Shows all tools affected before allowing one operation; one tool cannot be granted in isolation.
Allow selected operation	Allows the operation shared by the chosen tool after confirmation, subject to safety restrictions.
Restore prior permission	Restores the earlier operation policy if nobody has changed it since the guided step.
Pending approvals	Shows guarded calls waiting for an administrator and when each approval expires.
Approve	Approves one exact pending call once; only a signed-in administrator on this page can approve.
Deny	Refuses the selected pending call without running it; requires browser confirmation.
Recent decisions	Shows recorded approvals and refusals from the guard's audited decision history.

Routes and boundaries

Route	Used by
`GET /api/agent/status`	Agent status and guided connection checks
`GET /api/agent/permissions`	Agent permissions and permission previews
`POST /api/agent/permissions`	Save permission, Allow shared operation and Restore previous permission
`POST /api/ux/agents/conditional-permission`	Administrator-only guided apply and conflict-checked undo; delegates persistence to the permission owner
`GET /api/mcp/tools`	MCP tool catalog and scope preview; also available to clients
`POST /api/mcp/call`	Try guarded tool, using the existing authenticated call owner
`POST /api/mcp`	Machine-to-machine protocol only, not a browser form
`GET /api/guard`	Agent approvals, recent decision history and guard mode

All state-changing actions are audited by their existing owners. Guard mode, pending calls and the operation table are available at Agent approvals; the mode and approval window displayed there are read from the active state, not inferred from the browser. For access and credentials see Panel Network and Access, and for navigation see Panel Navigation and Help.