Cloudgate
Start free trial
MenuClose

Agents

An Agent is a member of your Organization that is not a person. Create one when you want an AI tool such as Claude Code, Cursor or Codex to read your Services or deploy them through the MCP endpoint.

Owner or AdminEvery plan

An Agent has its own role, its own grant to the Projects, Environments and Services it may reach, and its own agent keys. It acts only through the MCP endpoint, the console’s address plus /mcp, and every call it makes, allowed or refused, is a row in the audit log.

What you can do

  • Create Agents with the Reader, Operator or Caller role.
  • Grant each one only the Projects, Environments and Services it needs.
  • Issue, rotate and revoke its agent keys.
  • Suspend an Agent at once, and resume it later.
  • Copy ready-made configuration for Claude Code, VS Code, Cursor and Codex CLI.

Agent roles

Role What it can do
Reader (default) Reads what it is granted: Services, Environments, Deployments, Deployment logs and Domains. Changes nothing.
Operator Everything a Reader can, and deploys, starts, stops and cancels Deployments of what it is granted. Cannot change settings, variables or access.
Caller Calls the AI models it is granted through the Gateway, and nothing else. Gets no tools over MCP.

Create an Agent

  1. Open Agents

    Open Settings > Agents and press Create an Agent.

    cloudgate.octabyte.app/settings/agents
    Each Agent shows its role, what it can reach, its keys and when a client last connected.

  2. Name it and pick a role

    Give it a Name that says what it is for, such as deploy-bot or staging reader; it is how the audit log names it. Pick a Role: Reader is selected by default.

  3. Grant access

    Under Access, tick what it may reach, for example the storefront Project’s staging Environment. Access starts empty, and granting a Service grants its Project and Environment too. You can save it with nothing granted and grant it later.

  4. Choose when its first key expires

    Under First key expires, choose In 30 days, In 90 days (the default) or In a year. Press Create Agent.

  5. Copy the key

    The first key is shown once. Copy it into your MCP client’s secret storage now.

Connect an MCP client

On the Agent’s row, press Connect. The panel holds the configuration for Claude Code (.mcp.json), VS Code (.vscode/mcp.json), Cursor (~/.cursor/mcp.json), Codex CLI (~/.codex/config.toml) and any other client. Each sends the key as Authorization: Bearer <agent key> to your console’s address plus /mcp.

cloudgate.octabyte.app/settings/agents
Pick your client and paste its snippet; the key stays in your client's secret storage.

Step-by-step client setup is in Connect an MCP client.

Rotate, suspend or delete an Agent

  • Add key issues another key with its own expiry. To rotate, add a key, switch the client to it, then Revoke the old one. An expired key shows Remove.
  • Suspend refuses its next call through the MCP endpoint, and every one after, until you press Resume.
  • Change role and Manage access change what it can do and reach.
  • Delete removes the Agent, its access and all its keys. Its audit trail stays.

What you cannot do

Questions

Can an Agent apply a Plan or change settings?

No. An Agent can ask for a Plan but never applies one, and never changes settings, variables, access, Uptime checks or thresholds.

Does an Agent see my secrets?

No. Every tool result, logs included, passes through a mask that replaces stored secret values with dots.

What happens when the person who made an Agent leaves?

Nothing. An Agent outlives whoever created it; it belongs to the Organization.

Can I use a personal key for an agent instead?

No. The MCP endpoint refuses personal keys. Create an Agent and use its agent key.

Something missing or wrong on this page? Email support@octabyte.io, or start a free trial and try it in the console.