Vapi MCP server and Dome

1. 01

   Add the Vapi MCP server

   Every agent shares one Vapi API key. Dome holds it and sends it as a Bearer token.

   $ dome tools add --name vapi \
     --url https://mcp.vapi.ai/mcp \
     --auth-method api-key \
     --credential-type shared \
     --authorization "Bearer $VAPI_API_KEY" \
     --gateway voice-gateway

2. 02

   Sync the catalog

   Vapi won't list its tools for a bad key, so sync with the real one.

   $ dome tools catalog sync vapi

3. 03

   Apply the rules

   The rules are scoped to renewal-caller. Simulate a call to a number outside +1, then deploy.

   $ dome rules apply vapi-calls.cedar \
     --agent renewal-caller --name vapi-calls

4. 04

   Cap the agent's calls

   Two hundred a day for renewal-caller, counting every Vapi tool it calls.

   $ dome quotas set --subject agent --agent renewal-caller \
     --dimension tool --unit calls --limit 200 --window daily

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Vapi itself, see Vapi's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "vapi" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "vapi" &&
  ["create_assistant", "update_assistant", "create_tool", "update_tool"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "vapi" &&
  resource.tool_name == "create_call"
}
unless {
  resource has arguments &&
  resource.arguments has assistantId &&
  resource.arguments has customer &&
  resource.arguments.customer has number &&
  ["asst-renewal-reminder", "asst-appointment-confirm"].contains(resource.arguments.assistantId) &&
  resource.arguments.customer.number like "+1*"
};