Interface and guidance
Tools provide authority. Skills explain how to use it.
BYOAg separates callable platform actions from declarative operating guidance. That distinction keeps permission enforcement out of prose and prevents a remote skill from becoming executable software.
Implemented connector surface
Six tools manage the connection lifecycle
The plugin exposes one local MCP server. Its current tools discover platforms, pair accounts, inspect local registrations, retrieve signed engagements, and disconnect cleanly.
byoag_discover
Read onlyValidate public BYOAg metadata from an exact domain without connecting an account.
byoag_begin_pairing
Changes stateCreate a local pairing session and pairwise installation material.
byoag_complete_pairing
Changes stateRedeem protected pairing material or poll platform confirmation.
byoag_list_registrations
Read onlyReturn public local registration metadata without credentials.
byoag_list_engagements
Read onlyFetch and validate signed engagements for one local registration.
byoag_disconnect
DestructiveRevoke one registration and remove its local BYOAg state.
Two MCP planes
Connection tools are not experience tools
Available now
Local lifecycle connector
A stable, platform-neutral surface manages discovery, registration, engagement retrieval, and disconnect. It does not encode each platform’s business actions.
Proposed next layer
Engagement-scoped platform tools
A future resolver exposes only the concrete tools mapped to authorized capabilities for one named engagement. Every invocation is still re-authorized by the platform.
Tool invocation
Discovery is never approval
- 1. Select one engagement-scoped tool.
- 2. Attach the engagement credential outside model context.
- 3. Re-evaluate role, delegation, limits, and current policy server-side.
- 4. Require protected confirmation for consequential operations when policy says so.
Structured result
Make decisions auditable
A completed action should return a structured result and an audit reference. Retries of consequential actions need an idempotency key so a network failure cannot silently duplicate an effect.
Tool availability alone never proves that the present call is permitted.
Declarative skill bundles
Scoped guidance, verified before activation
A platform may eventually publish signed instructions, references, examples, and schemas that teach an agent how to use an authorized tool surface. The content remains lower authority than system, developer, user, client-safety, and platform policy.
- 01 Match the declared issuer and engagement role.
- 02 Verify the manifest signature and content digest.
- 03 Accept only supported declarative formats and versions.
- 04 Resolve every required capability within the active grant.
- 05 Keep the skill as an engagement-scoped overlay.
- 06 Reject executable scripts, binaries, installers, hooks, and HTML.
Updates inside the envelope
Compatible guidance may refresh
A signed update that stays within the existing capabilities, data access, and effects may activate according to client policy.
Material expansion
New authority requires new consent
New tools, scopes, data access, side effects, or materially different behavior require renewed user approval. A signed bundle cannot widen the grant by itself.