What an agent sees
Five tools, not all. The catalog is reached through them:
Listing all supported tools with their schemas is a ~844 KB, ~215k-token
tools/list — and most clients inject that on connect whether a tool gets used or not. The gateway is ~5.2 KB.
Listing is not permission:
tools/call still resolves any tool by its own name. run_tool makes names discoverable, it doesn’t gate them.The full listing
If your client loads tools lazily (Claude Code, the Claude API’s tool-search), it pays no context for tools it doesn’t touch and typed schemas beat a genericrun_tool. Ask for the catalog on the connect URL:
inputSchema and outputSchema — the same ones describe_tool and the OpenAPI document give. Names are the slug, / replaced by __ (MCP names can’t contain slashes): case-converter, html-generator__button. The five tools above are still there.
Don’t use it on a client that loads eagerly — that’s the 215k-token bill, mostly wasted.
Cost
Same meter as REST: everytools/call on a real tool costs credits, refunded if the call fails. run_tool costs exactly what the inner tool costs. See Credits.
Your agent can’t spend credits without asking
Nothing about a tool-calling loop naturally stops at your allowance — so every paid call is put up for approval before anything is charged. Every one, not just the first: there is no “remember this” and no per-session allowance. Clients that implement MCP elicitation surface that as a prompt, quoting the price:String Case Converter costs 3 credits. Run it?
The server always asks; how your client presents the question is the client’s choice. One that auto-approves without showing you anything is still behaving within the protocol. If it matters to you, check how yours handles elicitation — we can guarantee the ask, not that a human sees it.
The prompt lands after your inputs are validated and before any credit moves — the only window where “no” is free. Through
run_tool it quotes the inner tool’s price, so the gateway is no way around it.
The quoted number is what gets charged; it can only end up lower, never higher. Failed runs are refunded in full, and per-unit tools that under-deliver refund the shortfall.
Free tools never interrupt you, so an agent can search, read a schema and check your balance without asking — then ask once, for the call that spends something.
If your client can’t show a prompt
Those clients keep working — each tool’s price is in its description anyway. To run a blocked tool, call REST directly with the same key — you’re the one pressing enter:Authentication today
Pass your API key as a Bearer token in the client config — see Install.OAuth is not available yet. Configure the key manually — it is the same key the REST API uses.