Skip to main content

​
Numbers

Plan quotas still apply. create_agent succeeds when the workspace has no free agent slot, but the agent comes back with active: false and does not run until a slot frees up. See Plans and billing.

​
Scope

A key reaches one workspace, entirely. Every tool resolves its target through the same ownership check the app uses, so an agentId or a spaceId from another workspace comes back as Agent not found or Box not found, never as a partial answer. There is no read-only key, no per-agent key and no per-tool permission. If you need a narrower blast radius, use a separate workspace.

​
What the API refuses to do

attach_connector declares a connector and stops there. API keys, OAuth sign-ins and passwords are entered by the account owner in the app, and they are stored on the Box, never in the Rerun database. plan_template_capture returns credential variable names only, never values.
submit_template moves a draft to review. Publishing is the Rerun team’s decision. Payout onboarding needs a browser.
No billing, no plan change, no subscription, no member or invitation management, no workspace creation, no Box creation. Create a Box in the app first.
You cannot mint or revoke a key over MCP. That would let a leaked key extend itself.
The API covers prompts, skills, schedules, triggers, connectors, databases and runs. Memory entries and workspace files are reached by the agent itself, or by you in the app.
add_template_image takes a public https URL and re-hosts the bytes. Produce the image elsewhere.

​
Guarantees

  • Destructive tools ask twice. Seven tools refuse to run without confirm: true. See Destructive tools.
  • Skills are written atomically. upsert_skill stages the whole folder and swaps it in, so a failed call never leaves a half-written skill.
  • Multi-statement SQL is transactional. db_execute and space_db_execute with statements apply all of them or none.
  • A tool error is readable. Failures come back as isError results with a message written to be acted on, not as an opaque protocol error. See Errors.
  • Renaming is safe. Changing an agent name never moves its handle, so @handle references in other agents keep resolving.

​
Availability

The MCP endpoint and the webhook front door run on the Rerun app. The agents themselves run on your Box. A Box that is shut down or restarting makes agent-facing tools fail with a reachability error, while catalog tools like list_connectors keep working.