Give agents a narrow path through the reporting runtime

Rahoto's documented public agent contract is the versioned Publishing API. With an accepted API key, an agent can list publications, read one, start a dry or delivered run, and check the run's status.

Rahoto does not advertise a public Rahoto-hosted MCP endpoint, because there is none yet. If your agent speaks MCP, wrap the Publishing API in an MCP server you run; that adapter is then your security boundary.

list_publications

Read-only; returns the publications the caller can choose from.

get_publication

Read-only; verifies one selected publication in the same organisation.

dry_run_publication

Starts a render with delivery disabled and returns the run identifier.

deliver_publication

Starts a delivering run, only after an explicit approval step.

get_run

Reads one run with bounded polling, a timeout, and tenant verification.

Keep delivery separate from the dry run, so a model cannot turn a harmless preview into an external side effect. Check identifiers against the list returned for the same principal instead of accepting arbitrary prompt text.

1. Use a dedicated, expiring key. Scoped keys are not available yet; see the API guide.
2. Allowlist organisation and publication identifiers in the tool layer.
3. Default the run tool to dryRun: true.
4. Require a person's approval before delivery, unless a separately reviewed schedule owns that decision.
5. Keep API keys, report data and private viewer URLs out of prompts, logs, browser code and report content.
6. Record the tool input, principal, publication, run identifier, approval and outcome, without copying report data you do not need.
7. Stop on a disabled publication, an access-policy conflict, a missing permission, or a failed reconciliation or preflight.

Point retrieval systems at stable public pages: the About page, the automated board-reporting workflow, the connector catalogue, this guide, and the public OpenAPI document. A model's memory is not a reliable source for current capabilities.

Letting a crawler read a page does not let a model operate a workspace or open a private report. Crawling, search retrieval and agent operation are separate permissions.