Ask Claude who can open what.
Everything the Access Management screen does is also an agent tool, and so is the fleet's health. A coding or planning agent can grant a new hire a set of tools, take access away from someone who left, or list the sites in the registry, without a browser. The dashboard itself runs on a small REST API.
The agent tools
Aerie mounts a FastMCP server at /mcp on the same backend as the API, over streamable HTTP, and a small stdio bridge relays the same tools for local agents. The tools change who can open what, so the mount is guarded: a request needs a service token in a header, or an admin's sign-in, and with no token configured every request is refused.
| Job | Tools |
|---|---|
| The fleet | list_fleet_tools, get_tool, list_registry_tools, list_websites |
| What a person sees | list_visible_tools, get_user_grants |
| People | list_dashboard_users, get_user, get_user_by_email, create_user, delete_user, set_user_admin |
| Grants | grant_tool_access, revoke_tool_access, bulk_grant_tool_access, get_grant_matrix |
| Health and diagnostics | get_fleet_health, get_tool_health, get_diagnostics |
The REST routes
The screens call a plain JSON API under /api/v1, and every route needs a sign-in. The ones below are the ones the dashboard and launcher use; the admin routes refuse anyone who is not an admin.
| Route | What it does |
|---|---|
| GET /me | Who you are; creates your record on the first call. Returns whether you are an admin. |
| GET /me/assignments | Your open work from Lectern, Docket, and Slate; each source reports ok or its error. |
| GET /tools, /tools/recent, /tools/all | The tools you may see, your recent five, and the whole registry for the command bar and the admin screen. |
| POST /tools/{key}/launch | Records that you opened a tool, for the Recent row. A coming-soon tool is refused. |
| GET /fleet-status | A health state for each tool, from Vigil, with a stale flag. It never fails the page. |
| GET /websites | Every active site in the registry. |
| GET /admin/matrix, /admin/users | The whole grant matrix in one call, and the people list with grant counts. |
| POST /admin/users, and PATCH and DELETE on a single person's record under /admin/users | Add a person, toggle admin, remove a person. |
| PUT /admin/grants, POST /admin/grants/bulk | Change one grant, or many for one person as a single change. |
| POST /admin/registry/refresh | Ask the backend to read the registry document now. |
How agents sign in
Machine callers use a hashed service token or a static API key; an API key identifies a machine and is never an admin. People use the fleet's own sign-in. In local development a flag swaps all of this for a stub administrator, and a deployed environment refuses to start with that flag on.
Questions about this tool?
Write to Renkara Media Group and a person will answer.