ElevenLabs MCP and Dome

1. 01

   Register the voice agent

   Name the tools it may call and the Gateway it reaches.

   $ dome agents register --name support-voice \
     --tool hubspot/search_crm_objects \
     --tool hubspot/get_crm_objects \
     --tool hubspot/search_owners \
     --gateway support-gateway

2. 02

   Create its key

   The response carries the key and the Gateway's MCP URL. Store the key in ElevenLabs and nowhere else.

   $ dome agents create-key support-voice --name elevenlabs --gateway support-gateway

3. 03

   Apply the rules

   The Gateway grant opens every tool on the Gateway, so the forbid narrows it to three. Simulate before you deploy.

   $ dome rules apply support-voice.cedar \
     --agent support-voice --name support-voice

4. 04

   Add the Gateway to ElevenLabs

   In ElevenLabs, open the MCP server integrations and add a custom MCP server. Paste the MCP URL, set the secret token to Bearer and the key, then attach the server to your agent.

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about ElevenLabs Agents itself, see ElevenLabs's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "hubspot" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
unless {
  resource.connection_name == "hubspot" &&
  ["search_crm_objects", "get_crm_objects", "search_owners"].contains(resource.tool_name)
};