Devin MCP and Dome

1. 01

   Register Devin

   Give it the GitHub tools it may call and the Gateway in front of them.

   $ dome agents register --name devin \
     --tool github/search_code \
     --tool github/get_file_contents \
     --tool github/create_pull_request \
     --gateway eng-gateway

2. 02

   Create its key

   The response holds the key and the MCP URL. Paste both into Devin and keep no other copy.

   $ dome agents create-key devin --name devin-mcp --gateway eng-gateway

3. 03

   Apply the rules

   Scope them to the devin agent. Simulate a merge to see it refused, then deploy.

   $ dome rules apply devin-github.cedar \
     --agent devin --name devin-github

4. 04

   Add the Gateway to Devin

   In Devin, open Customize, then MCPs, and add a custom MCP. Choose HTTP, paste the MCP URL, and set the Authorization header to Bearer and the key.

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Devin itself, see Cognition's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "github" &&
  ["search_code", "get_file_contents", "create_pull_request"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "github" &&
  !["search_code", "get_file_contents", "create_pull_request"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "github" &&
  resource.tool_name == "create_pull_request" &&
  !(resource has arguments && resource.arguments has owner &&
    resource.arguments.owner == "acme")
};