Claude Code MCP and Dome

1. 01

   Turn on interactive access

   List the developers who may sign in from Claude Code, by exact email or identity provider subject. Dome creates the Gateway's managed agent.

   $ dome gateways interactive enable eng-gateway \
     --email alice@example.com \
     --email bob@example.com

2. 02

   Permit what it may call

   The rule below goes on that managed agent. dome gateways get shows its name.

   $ dome rules apply interactive-access.cedar \
     --agent gateway-interactive-<gateway-id> \
     --name interactive-access

3. 03

   Add the Gateway to Claude Code

   Project scope writes .mcp.json, which holds no secret and can be committed. Run /mcp in Claude Code to sign in.

   $ claude mcp add --transport http --scope project dome \
     https://<gateway-host>/gateways/<gateway-id>/mcp

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Claude Code itself, see Anthropic's documentation.

permit (
  principal is Dome::Agent,
  action == Dome::Action::"mcp:discover",
  resource
);
 
permit (
  principal is Dome::Agent,
  action == Dome::Action::"mcp:call",
  resource is Dome::MCPTool
) when { resource.connection_name == "github" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "github" &&
  resource.tool_name == "merge_pull_request"
}
unless {
  principal has act_as &&
  principal.act_as.email == "alice@example.com"
};