Parallel Search MCP and Dome

1. 01

   Add the Parallel Search MCP server

   Dome stores the Parallel API key and sends it as a Bearer token on every call.

   $ dome tools add --name parallel \
     --url https://search.parallel.ai/mcp \
     --auth-method api-key \
     --credential-type shared \
     --authorization "Bearer $PARALLEL_API_KEY" \
     --gateway prod-gateway

2. 02

   Sync the catalog

   Sync needs a valid key, and Parallel refuses an invalid one. Without a sync, the Gateway has no Parallel tools to offer.

   $ dome tools catalog sync parallel

3. 03

   Block personal data in arguments

   A JSON filter on the request direction scans every argument. A match blocks the call before it reaches Parallel.

   $ cat > query-leak.json <<'EOF'
   $ {"json":{"components":[{"fieldActions":[{
     "matcher":{"contentMatchers":[{"ssn":{}},{"creditCard":{"requireLuhn":true}},{"email":{}}]},
     "action":"FILTER_ACTION_BLOCK"}]}]}}
   $ EOF
   $ dome guards filters create query-leak --config-from query-leak.json
   $ dome tools guards filters set parallel --direction request --filters query-leak

4. 04

   Apply the rules

   The rule is scoped to deal-scout. Simulate an objective that names the codename, then deploy.

   $ dome rules apply parallel-objectives.cedar --agent deal-scout --name parallel-objectives

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Parallel itself, see Parallel Web Systems's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "parallel" &&
  ["web_search", "web_fetch"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "parallel" &&
  resource has arguments &&
  resource.arguments has objective &&
  resource.arguments.objective like "*Halcyon*"
};