TinyFish MCP server and Dome

1. 01

   Add the TinyFish MCP server

   Dome holds the TinyFish API key and sends it as a Bearer token on every call.

   $ dome tools add --name tinyfish \
     --url https://agent.tinyfish.ai/mcp \
     --auth-method api-key \
     --credential-type shared \
     --authorization "Bearer $TINYFISH_API_KEY" \
     --gateway prod-gateway

2. 02

   Sync the catalog

   Sync needs a valid key. TinyFish won't list its tools without one.

   $ dome tools catalog sync tinyfish

3. 03

   Apply the rules

   The portal list is scoped to supplier-portal-reader. Simulate a run on an unlisted site, then deploy.

   $ dome rules apply tinyfish-permit.cedar tinyfish-sites.cedar \
     --agent supplier-portal-reader --name tinyfish-sites

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about TinyFish itself, see TinyFish's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "tinyfish" &&
  ["search", "fetch_content", "run_web_automation", "get_run"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "tinyfish" &&
  resource.tool_name == "run_web_automation" &&
  !(resource has arguments &&
    resource.arguments has url &&
    (resource.arguments.url like "https://portal.northwind-supply.com/*" ||
     resource.arguments.url like "https://b2b.harbor-parts.com/*"))
};