Give agents a narrow path through the reporting runtime.

Rahoto's documented public agent contract is the versionedPublishing API. An agent can list publications, read one publication, trigger a dry or delivered run, and inspect run status when its API key is accepted by the corresponding route.

This documentation does not advertise a public Rahoto-hosted MCP endpoint because this repository does not expose one as a supported public contract. An MCP client may wrap the Publishing API in its own server, but that adapter remains the operator's security boundary until Rahoto publishes a native endpoint and protocol contract.

list_publications

Read-only; returns the caller's available publication choices.

get_publication

Read-only; verifies one selected publication in the same organisation.

dry_run_publication

Starts a render with delivery disabled and returns the run identifier.

deliver_publication

Starts a delivery-capable run only after an explicit approval boundary.

get_run

Reads one run with bounded polling, timeout, and tenant verification.

Keep delivery separate from dry run so a model cannot turn a harmless preview intention into an external side effect. Validate identifiers against the list returned for the same principal rather than accepting arbitrary prompt text.

1. Use a dedicated expiring key; review the current scoped-key provisioning limit in the API guide.
2. Allowlist organisation and publication identifiers in the tool layer.
3. Default the run tool to dryRun: true.
4. Require explicit human approval before delivery unless a separately reviewed deterministic schedule owns that authority.
5. Do not put API keys, report data, or private viewer URLs into prompts, logs, browser code, or report content.
6. Record tool input, principal, selected publication, run identifier, approval, and outcome without copying unnecessary report data.
7. Stop on disabled publications, access-policy conflicts, missing permission, reconciliation failure, or preflight failure.

Point retrieval systems to stable, crawlable evidence: the Rahoto entity,automated board-reporting workflow,production connector catalogue, this guide, and the public OpenAPI document. Do not rely on model memory as an authority for current capabilities.

Model-training crawler policy, live search retrieval, and secure agent operation are separate decisions. Allowing a page to be crawled does not grant a model permission to operate a workspace or view a private report.