Agent Surface Engine

Constrain which MCP tools/paths agents may use with surface_enforce.

What you will learn

• surface_get
• surface_plan
• surface_enforce

Prerequisites

• Mount PluginHost and merge MCP tools

Surface

What this feature does

Agent Surface declares allow/deny lists for tools and filesystem roots. Hosts should surface_enforce before broad tool access in untrusted sessions.

How to call it

Call these MCP tools through your AGS / tower-gov host — surface_get, surface_validate, surface_enforce, surface_plan.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.

1. surface_get
2. surface_plan
3. Apply remediation
4. surface_enforce

{
  /* Example MCP call — fill args from schema_get / docs */
  "tool": "surface_get",
  "arguments": {}
}

What success looks like

surface_enforce ok

Policy matches live state

Common failure modes

Config enabled but requiredFiles missing

Enforce without validate

Plan ignored

Related reference

• Configuration
• Architecture