Skyfire and Dome

1. 01

   Add the Skyfire MCP server

   Skyfire reads its key from a skyfire-api-key header. Dome stores the key once and sends it in that header on every call.

   $ dome tools add --name skyfire \
     --url https://mcp.skyfire.xyz/mcp \
     --auth-method api-key \
     --credential-type shared \
     --authorization "$SKYFIRE_API_KEY" \
     --header-secret skyfire-api-key=Authorization \
     --gateway data-gateway

2. 02

   Sync the catalog

   Sync needs a valid key. Until it runs, agents get “tool not available in this gateway”.

   $ dome tools catalog sync skyfire

3. 03

   Apply the rules

   Scope them to one agent while you try them. Simulate before you deploy.

   $ dome rules apply skyfire-payments.cedar \
     --agent data-buyer --name skyfire-payments

4. 04

   Cap the agent's calls

   Fifty tool calls a day, across every tool the agent reaches.

   $ dome quotas set --subject agent --agent data-buyer \
     --dimension tool --unit calls --limit 50 --window daily

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Skyfire itself, see Skyfire's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "skyfire" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "skyfire" &&
  ["create-pay-token", "create-kya-payment-token"].contains(resource.tool_name)
}
unless {
  resource has arguments &&
  resource.arguments has sellerServiceId &&
  resource.arguments has amount &&
  // Dappier Search
  ((resource.arguments.sellerServiceId == "81085b79-68d8-4a46-9f8c-63c11a969828" &&
    ["0.50", "1.00"].contains(resource.arguments.amount)) ||
   // Your Apify seller service
   (resource.arguments.sellerServiceId == "<apify-service-id>" &&
    resource.arguments.amount == "5.00"))
};