Access Tiers

Shared tools are filtered by API key tier.

The client does not choose what tier it wants. The key already encodes that.

Tier Map

Current Examples

ToolTier
google-workspacestandard
infAct Browser (browser-use)standard
github-mcp-cloudadmin
livekit-docsadmin

Why It Matters

This is how the platform prevents a normal user runtime from receiving:

  • org PAT-backed GitHub access
  • internal admin integrations
  • internal infrastructure helper surfaces

A client that serves both end users and operators should hold both keys and pick at call time:

  • INFRASTRACTURE_API_KEY_STANDARD — end-user sync and standard shared-tool access
  • INFRASTRACTURE_API_KEY_ADMIN — operator workflows only

Never use the admin key on a code path that runs in response to an end-user request. That is the single most important rule on the platform.