# io.agent4/agent4-tenant Build and run grounded business agents over MCP: agents, knowledge bases, skills, Storylines. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.4.0 - **Author:** io.agent4 - **License:** Unknown - **Endpoints:** streamable-http https://api.agent4.io/v1/mcp - **Source:** https://agent4.io - **Endpoint health:** reachable (last checked 2026-09-22T05:23:58.326Z, 5 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 2 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-22T05:23:58.326Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `create_agent` tool: Imperative addressed to the AI model - injection-shaped content (note) in the `set_custom_domain` tool: Links to undeclared domain: chat.client.com - injection-shaped content (note) in the `create_skill` tool: References the system prompt - injection-shaped content (note) in the `build_knowledge_index` tool: Imperative addressed to the AI model - injection-shaped content (note) in the `improve_prompt` tool: References the system prompt ## Tools 50 declared. Observed from a live `tools/list` probe. - `list_agents` — List all agents in this tenant (name + published state). - `get_agent` — Get one agent's full configuration (soul/task/tools/skills/knowledge_bases/model/params). - `create_agent` — Create an agent. `name` is lower-cased on save — it is a key, not a display name. soul = persona/identity; task = duties and boundaries; tools = tool-name white - `update_agent` — Update **part** of an agent — fields you don't pass stay as they are. ⚠️ List-field semantics, don't mix them up: `tools=[...]` / `skills=[...]` / `knowledge_ba - `list_tools` — List tool names assignable to agents, with their descriptions (incl. the tenant's connected MCP tools). - `list_mcp_servers` — List the MCP servers connected in this tenant's tool library (read-only; secret fields omitted). - `create_share` — Create a **share / integration entry point** for an agent — this is how end users actually reach it. **`published=True` only means "visible", not "reachable"**: - `list_shares` — List an agent's shares (token / label / disabled / chat link / embed URL / appearance config). When the top-level `pretty_url` is non-empty it is the preferred - `configure_share` — Configure this share — its name and its **appearance** — fields you don't pass stay as they are (server-side partial merge). - `label`: the name at the top of t - `set_pwa_branding` — Configure a specific **agent's** PWA branding and install experience (applies to that agent's `/s/` standalone chat pages — what gets installed to the home scre - `set_custom_domain` — Bind the client's own domain to this tenant's chat pages: `https://chat.client.com/` serves the tenant's branded page (or a specific agent's chat), the address - `list_skills` — List this tenant's skills. - `get_skill` — Get one skill's full content (including the complete instructions text). - `create_skill` — Create a skill. description = "when to use" (goes into the system prompt, keep it short); instructions = the detailed guide (fetched on demand via load_skill). - `update_skill` — Update part of a skill — fields you don't pass stay as they are (server-side PATCH merge, no GET+PUT round-trip). ⚠️ `tools=[...]` is **full-list replacement**; - `test_skill_trigger` — Reality-check whether your prompts actually trigger tool calls (dry-run) — run this after writing/changing a skill instead of counting corpses in production. Re - `list_knowledge_bases` — List this tenant's knowledge bases (with doc/chunk counts and relevance cutoff). - `get_knowledge_base` — Get one knowledge base's configuration (including the full instructions text shown to the model). - `create_knowledge_base` — Create a knowledge base. **Write `description` — it is what routes questions to this base.** Before each answer the platform reads every attached base's `descri - `update_knowledge_base` — Update part of a knowledge base — fields you don't pass stay as they are (server-side PATCH merge). - `add_knowledge_text` — Add a **text** document to a knowledge base (chunking + embedding happen synchronously; returns the real chunk count). For **local files** (pdf/docx…) see `add_ - `add_knowledge_file` — Add a local file's content to a knowledge base (txt/md/html/pdf/docx). **This MCP runs on the platform server and cannot read paths on YOUR machine.** For text - `search_knowledge_base` — Search this knowledge base; returns matching chunks with distances. Uses **exactly the same retrieval path as real conversations** — use it to validate the cuto - `build_knowledge_index` — Build (or rebuild) the structured index for a knowledge base — the second leg beside vector search. Vector search answers "what does this passage say". It **can - `get_knowledge_index` — Show the structured index profile: per column coverage, type, numeric range, top values, warnings. **The warnings are the point.** On a real 4,500-document cata - `patch_knowledge_index` — Change the structured index schema from one sentence of plain language. Example requests: "also track the author so users can find other books by them", "I want - `improve_prompt` — Rewrite a field's text to work better as an AI system prompt; returns the improved text. field ∈ persona | task | greeting | storyline_task | storyline_opening - `diagnose_prompt` — Read a field and return a list of **specific** improvement suggestions (string array). field: same values as improve_prompt. current = the text to diagnose (req - `test_planner_trigger` — Dry-run the Dynamic Planner's escalation judge: would these messages be offered a step-by-step plan? Use it after editing the agent's `task`, since the task tex - `preview_plan` — Generate a plan for a goal and return it for review **without persisting anything** — no temporary storyline, no enrollment, no user affected. Use it to inspect - `usage_stats` — Usage statistics. group ∈ total | agent | user | space | day | model. Metadata only — token counts and event counts, never any conversation content. Use group=" - `tenant_info` — This tenant's basic info and quota (plus custom-domain binding status, if any). - `search_agent4_docs` — Search agent4.io's own product docs — concepts (what a thing *is*) and cookbook recipes (which tool to *call*). Use when you're unsure how an agent4.io feature - `list_end_users` — List this tenant's **end users** (the people chatting with your agents) — roster only, never any conversation content. Each user carries: display name, login me - `get_end_user` — Get one end user's detail: basic profile (name, contact email/phone, city, timezone) + their spaces. Never any conversation content. Carries a `console_url` to - `list_user_sessions` — List one end user's **sessions** — metadata only: agent, title (AI summary), message count, tokens, timestamps. **Message bodies are not returned.** Transcripts - `list_page_contexts` — List all page playbooks of this tenant (with match rules, greeting mode, position). - `upsert_page_context` — Create or fully replace a page playbook. `context` is the page background the **server** injects for the agent — write "who lands on this page, what they are de - `resolve_page_context` — Given a URL (or key), show which playbook it resolves to — always verify after writing a match rule. Globs make it easy to write rules that "look right but neve - `page_context_stats` — Open counts and suggested-question click counts per playbook — find copy nobody clicks. - …and 10 more ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"agent4-tenant\": {\n \"type\": \"http\",\n \"url\": \"https://api.agent4.io/v1/mcp\"\n }\n }\n}" ``` ## Blast radius Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: mutates data; runs on someone else's infrastructure. - Floor 26, ceiling 50 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/io.agent4%2Fagent4-tenant - Install plan: https://forgeregistry.com/api/v1/packages/io.agent4%2Fagent4-tenant/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/io.agent4%2Fagent4-tenant - HTML page: https://forgeregistry.com/registry/io.agent4%2Fagent4-tenant - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.