Apollo.io MCP server and Dome

1. 01

   Add the Apollo MCP server

   Dome registers itself with Apollo's OAuth server. Each rep signs in to Apollo once, and Dome stores their token.

   $ dome tools add --name apollo \
     --url https://mcp.apollo.io/mcp \
     --auth-method oauth \
     --credential-type per-user \
     --oauth-client-origin dcr \
     --oauth-authorize-url https://mcp.apollo.io/mcp/oauth_metadata/redirect_to_authorize \
     --oauth-token-url https://mcp.apollo.io/api/v1/oauth/token \
     --oauth-revoke-url https://mcp.apollo.io/api/v1/oauth/revoke \
     --oauth-registration-url https://mcp.apollo.io/api/v1/oauth/applications/register_oauth_client \
     --gateway prod-gateway

2. 02

   Sync the catalog

   Sync runs with your own Apollo sign-in, so connect your account first. Until it runs, agents get “tool not available in this gateway”.

   $ dome tools catalog sync apollo

3. 03

   Apply the rules

   Scope them to one agent while you try them. Simulate before you deploy.

   $ dome rules apply apollo-lookups.cedar --agent lead-enricher --name apollo-lookups

4. 04

   Cap the calls

   The quota counts every tool call the agent makes. Past the limit, calls are refused until the window resets.

   $ dome quotas set --subject agent --agent lead-enricher \
     --dimension tool --unit calls --limit 200 --window daily

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Apollo itself, see Apollo.io's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "apollo" &&
  ["apollo_mixed_people_api_search", "apollo_mixed_companies_search",
   "apollo_organizations_enrich", "apollo_people_match"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "apollo" &&
  !["apollo_mixed_people_api_search", "apollo_mixed_companies_search",
    "apollo_organizations_enrich", "apollo_people_match"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "apollo" &&
  resource.tool_name == "apollo_people_match" &&
  resource has arguments &&
  resource.arguments has reveal_personal_emails &&
  resource.arguments.reveal_personal_emails == true
};