Harvey MCP and Dome

1. 01

   Turn on interactive access

   Name who may sign in, by exact email or identity provider subject. Dome creates one managed agent for the Gateway.

   $ dome gateways interactive enable firm-gateway \
     --email partner@example.com \
     --email associate@example.com

2. 02

   Permit what it may call

   Apply the rule below to the managed agent. Its name is in dome gateways get.

   $ dome rules apply harvey-notion.cedar \
     --agent gateway-interactive-<gateway-id> \
     --name harvey-notion

3. 03

   Add the Gateway to Harvey

   A Harvey workspace admin adds the Gateway's MCP URL as the firm's own server and enables it. Each lawyer then signs in once from Harvey.

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Harvey itself, see Harvey's documentation.

permit (
  principal is Dome::Agent,
  action == Dome::Action::"mcp:discover",
  resource
);
 
permit (principal is Dome::Agent, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "notion" &&
  ["notion-search", "notion-fetch", "notion-create-pages"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "notion" &&
  resource.tool_name == "notion-create-pages"
}
unless {
  principal has act_as &&
  principal.act_as.email == "partner@example.com"
};