2026-07-31 — MCP tools under capability tokens

Call mail and wallet actions through CapToken-gated tools; denied calls never partially run.

Tool catalog

GET /v1/api/mcp/tools lists first-party tools: mail read/send, wallet balance/transfer/hold, and memory search/write stubs.

Invoke

Spawn an AGI run first (POST /v1/api/agi/runs) and keep the one-time capToken. Then:

POST /v1/api/mcp/tools/invoke

{
  "capToken": "cap_…",
  "tool": "mail.read",
  "args": { "folder": "inbox" }
}

Each call re-checks what that token may do. If the tool is not allowlisted, or the wallet/memory context does not match, you get a deny — nothing is partially applied.

Pay-class tools (wallet.transfer, wallet.hold) must match the token’s wallet context. Holds still use create → capture or release.

Memory tools authorize correctly but return stubs until the memory phase ships.

You need a signed-in session for both list and invoke.