Agents do better work with your other tools at hand: the error in Sentry, the ticket in Linear, the dashboard in Grafana. They reach those through MCP servers, and in Ryph every call goes through the tool proxy.
The keys to your tools stay sealed in Ryph. A run gets a token that works only for that run, and sees only the tools its agent was given. The proxy checks each call, sends it on with the real key and records it. When the run ends, its token stops working.
The run
Run r-7f3a
A token for this run only
Tools it can see
- sentry__get_issue_details
- linear__list_issues
- linear__get_issue
Ryph’s tool proxy
Checks every call
- sentry__get_issue_details Sent with Sentry’s key
- linear__list_issues Sent with Linear’s key
- linear__delete_issue No such tool
Your tool servers
Sentry Key in Ryph
Linear Key in Ryph
Grafana Key in Ryph
What a run holds
- A token for itself. Ryph makes one when the run starts, and hands it to the run in an environment variable. It works only for this run and only for the servers the agent was given. It stops working when the run ends, and after 12 hours at most.
- An address per server. The agent’s harness connects to each server through the proxy, at an address made for the run.
- No key to any of your tools. Someone who steals the token from a run gets a credential that works for one run, for its tools, and only until the run ends.
What the proxy checks
- The token, the run and the server. A call has to come with the run’s token, to a server that run was given.
- Which tools the agent sees. When the agent asks a server what it offers, the proxy drops every tool the agent wasn’t given, so the model doesn’t see them.
- Which tools the agent calls. A call to a tool outside the agent’s list is answered as if the tool didn’t exist, and doesn’t reach the server.
- What else the agent asks for. Listing and calling tools are all a run can do. MCP’s other features, such as resources and prompts, are refused before the server is asked.
- How much a run calls. A run can make 10,000 requests through the proxy. Past that, the proxy refuses them. Where the MCP gateway runs as a separate service, on Networked Compose or Kubernetes,
RYPH_MCP_PER_RUN_REQUESTSchanges the limit.
Every call is recorded with its run: which tool, when, and how it went.
Add a tool server
Go to Tool servers and click Add server. Adding and changing servers takes an operator or an owner.
-
Pick the server
Choose one from the catalogue, or a custom server. Catalogue entries know their vendor’s address and how it takes a key, so they ask only for the settings that matter, such as a region or a project.
-
Paste the key
Paste the API key or token for the server. Ryph seals it, and doesn’t show it again. The server’s list shows its last four characters, so you can tell keys apart.
-
Probe it
Probe connects with the real key and lists the server’s tools, with their descriptions. If the key is wrong or the server is unreachable, it says which.
The catalogue has these:
| Server | How it’s reached | What it can’t do until you allow it |
|---|---|---|
| Grafana | Hosted by Ryph, read-only by default | Writes, once you turn read-only off |
| Linear | Linear’s server, read-only by default | Writing issues, comments, projects and labels |
| Sentry | Sentry’s server, for one org | Updating issues, changing projects, alerts and monitors |
| Atlassian | Atlassian’s server | Every write in Jira, Confluence, Service Management and Bitbucket |
| Datadog | Datadog’s server, in your site | Writing notebooks, monitors, dashboards and cases, and running code |
| PagerDuty | PagerDuty’s server, US or EU | Every write: incidents, services, schedules and the rest |
| Stripe | Stripe’s server | Writes to the Stripe API, and moving money |
| Supabase | Supabase’s server, read-only by default | Running SQL, migrations, deploys and changes to the project |
The tools in the last column start switched off when you give an agent the server. Keys have scopes too, and a read-only key is the strongest limit you can set, so use one wherever the agent only needs to look.
A custom server is any MCP server that speaks streamable HTTP, with a bearer token, your own headers or no key. A server that only ships as a program can be hosted by Ryph as a custom container: an image pinned by digest, which serves MCP over HTTP.
Give an agent tools
Open Agents, pick the agent, click Edit, and go to Tools and memory. Under Tool servers, turn on Let this agent reach for each server it should use, and tick its tools. Tools that change things are marked, such as Changes things in Linear.
- Allow every tool the server offers gives the agent all of them, including tools the server adds later.
- Allow a tool by name adds one the probe didn’t list.
Runs keep the tools they started with. A change to the agent applies to its next run.
Built-in servers, under Advanced: built-in servers, are the tools Ryph provides itself: shared memory, posting in chat for a response, the forge and the web search and fetch tools. They go through the same proxy. Narrowing them can break features that rely on them, such as responses. Untick both web tools to keep an agent off the web.
Hosted servers
Many MCP servers ship as a program to run, with no address to call. Ryph runs those for you, on Docker through the launcher and on Kubernetes in a namespace of tool servers. Grafana’s comes from the catalogue, and a custom container works the same way.
- The key stays out of the container. Ryph keeps it sealed, and adds it to each call on the way through, as it does for a remote server.
- Runs can’t reach it. Hosted servers sit on a tools network that no run and no other Ryph service joins. Only Ryph’s tool guard sits in front of it, and each server takes calls only from the guard, so hosted servers can’t call each other.
- It reaches the public internet only. Its connections go through the egress proxy, which lets it reach public hosts and refuses private addresses, so it can’t reach your network or Ryph’s services.
The server’s row shows how it’s doing: starting, healthy, unreachable or stopped. Restart relaunches it, Logs shows its last lines with secrets blanked out, and Update image moves it to the version the catalogue pins, once a newer one is out. A deployment hosts up to 16 at once.
Where the proxy sends calls
The proxy only calls public HTTPS addresses. It refuses names that resolve to private, loopback or link-local addresses, and checks again before every call. It doesn’t follow redirects, so a public server can’t send your key on to a private one.
For a tool server inside your network, set RYPH_MCP_ALLOW_PRIVATE_UPSTREAMS, and RYPH_MCP_ALLOW_INSECURE for one on plain HTTP.
Changing the address of a server that has a key asks for the key again, so a key only goes where it was given for.
Turn a server off, or change its key
- Archive is the off switch. Runs that use the server lose it on their next call, and a hosted server’s container is removed.
- Rotate credential puts a new key in place of the old one. Running runs use the new key from their next call.
The egress allowlist doesn’t cover tools: a call to a tool goes through Ryph, to a server you chose. Any tool that writes, such as a comment, an issue or a message, can carry text out of a run. Give agents the tools that read wherever that’s enough, and use keys that can only do what the agent needs.
What to keep in mind
- What a tool returns is text from outside. An issue, an error report or a log line can carry instructions meant for the agent. The agent’s permissions, its network allowlist and the forge’s checks still hold, whatever it reads.
- Tools are allowed by name. If a vendor renames a tool, check the server’s list after a probe. Allow every tool the server offers includes tools that don’t exist yet.
- OAuth-only servers aren’t supported yet. That includes Notion and Figma. Servers that only run as a local program need to be packaged as a container that serves HTTP.
- GitHub and GitLab go through the forge. Ryph’s forge checks every GitHub and GitLab call against the agent’s forge policy, so there’s no tool server for either.