Get an agent's tool inventory
Lists the tools, MCP servers and hosts the gateway has seen the agent offer a model, call or reach, aggregated from the tool facts on its audit rows; stored bodies are never read. Each tool and server lists the sources it was seen in (declared, offered, called), and coverage reports what could not be seen, so an agent whose tools were not visible is never reported as having none. Declared sources are not available yet. The window defaults to the last 30 days and spans at most 90.
https://<host>/api/v1/agents/{agentId}/toolscurl --request GET \
--url 'https://<host>/api/v1/agents/{agentId}/tools' \
--header 'Authorization: Bearer <token>'const response = await fetch("https://<host>/api/v1/agents/{agentId}/tools", {
method: "GET",
headers: {
"Authorization": "Bearer <token>"
}
});
const data = await response.json();interface AgentToolsResponse {
agent_id?: string;
correlation_id?: string;
coverage?: Record<string, unknown>;
hosts?: Record<string, unknown>[];
mcp_servers?: Record<string, unknown>[];
tool_sets?: Record<string, unknown>[];
tools?: Record<string, unknown>[];
window?: Record<string, unknown>;
}
const response = await fetch("https://<host>/api/v1/agents/{agentId}/tools", {
method: "GET",
headers: {
"Authorization": "Bearer <token>"
}
});
if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
const data: AgentToolsResponse = await response.json();import requests
response = requests.get(
"https://<host>/api/v1/agents/{agentId}/tools",
headers={
"Authorization": "Bearer <token>",
},
)
response.raise_for_status()
print(response.json())package main
import (
"fmt"
"io"
"net/http"
)
func main() {
req, err := http.NewRequest(http.MethodGet, "https://<host>/api/v1/agents/{agentId}/tools", nil)
if err != nil {
panic(err)
}
req.Header.Set("Authorization", "Bearer <token>")
res, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer res.Body.Close()
data, err := io.ReadAll(res.Body)
if err != nil {
panic(err)
}
fmt.Println(res.Status, string(data))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://<host>/api/v1/agents/{agentId}/tools"))
.header("Authorization", "Bearer <token>")
.method("GET", HttpRequest.BodyPublishers.noBody())
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode() + " " + response.body());
}
}using System.Net.Http.Headers;
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://<host>/api/v1/agents/{agentId}/tools");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "<token>");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");<?php
$ch = curl_init('https://<host>/api/v1/agents/{agentId}/tools');
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => 'GET',
CURLOPT_HTTPHEADER => [
'Authorization: Bearer <token>',
],
CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
echo $status . " " . $response . PHP_EOL;require "net/http"
uri = URI("https://<host>/api/v1/agents/{agentId}/tools")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer <token>"
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
http.request(request)
end
puts "#{response.code} #{response.body}"// Cargo.toml dependencies: reqwest, tokio (features "full")
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let response = reqwest::Client::new()
.get("https://<host>/api/v1/agents/{agentId}/tools")
.header("Authorization", "Bearer <token>")
.send()
.await?;
println!("{} {}", response.status(), response.text().await?);
Ok(())
}Authorizations
BearerAuth· API key in header "Authorization" — Type "Bearer" followed by a space and a sign-in token: a Guardian Platform JWT, or an OIDC ID token in a standalone deployment.ApiKeyAuth· API key in header "Authorization" — Type "Bearer" followed by a space and a Guardian Platform API key. Project-scoped routes and registration tokens check the key's scopes and project binding. Per-agent routes accept a key bound to no project that has empty scopes or full access, which acts as its holder, or a scope for what the route does: submit_agent_assessments reads an agent (its detail, configurations, state history and the files a state references, definitions, tools and operating profile, as its assessments rest on), view_agent_certifications reads its certifications, and manage_programs or review_agent_assessments attach a certification. A state's raw snapshot and findings, its audit exchanges and plugin events, and saving its operating profile take full access. A scope counts only while the key's holder still holds that permission in the key's organization, which auth-service reports as keyHeldScopes. A key never acts as an admin, so its holder's binding to the agent still decides.
Parameters
Path parameters
| Name | Type | Description |
|---|---|---|
agentIdrequired | string | Agent ID |
Query parameters
| Name | Type | Description |
|---|---|---|
start | string | RFC3339 start time (default: 30 days before end) |
end | string | RFC3339 end time (default: now) |
Responses
200OK
agent_idstringcorrelation_idstringcoveragegithub_com_eqtylab_gateway_control-plane_service_internal_toolinventory.CoverageShow github_com_eqtylab_gateway_control-plane_service_internal_toolinventory.Coverage
calls_not_visibleintegerdeclaredgithub_com_eqtylab_gateway_control-plane_service_internal_toolinventory.DeclaredCoverageShow github_com_eqtylab_gateway_control-plane_service_internal_toolinventory.DeclaredCoverage
claude_code_configstringdefinitionstring
limitsstring[]llm_exchangesintegertools_not_visibleintegertools_readintegertools_unreadableintegerunread_endpointsgithub_com_eqtylab_gateway_control-plane_service_internal_toolinventory.UnreadEndpoint[]Show properties
Array of
github_com_eqtylab_gateway_control-plane_service_internal_toolinventory.UnreadEndpointexchangesintegeroperationstringproviderstring
hostsgithub_com_eqtylab_gateway_control-plane_service_internal_toolinventory.Host[]Show properties
Array of
github_com_eqtylab_gateway_control-plane_service_internal_toolinventory.Hostexchangesintegerhoststringlast_seen_atstringtraffic_kindstring
mcp_serversgithub_com_eqtylab_gateway_control-plane_service_internal_toolinventory.MCPServer[]Show properties
Array of
github_com_eqtylab_gateway_control-plane_service_internal_toolinventory.MCPServerhoststringnamestringrun_bystringsourcesstring[]tool_countinteger
tool_setsgithub_com_eqtylab_gateway_control-plane_service_internal_toolinventory.ToolSet[]Show properties
Array of
github_com_eqtylab_gateway_control-plane_service_internal_toolinventory.ToolSetcidstringexchangesintegerfirst_seen_atstringlast_seen_atstringtool_countinteger
toolsgithub_com_eqtylab_gateway_control-plane_service_internal_toolinventory.Tool[]Show properties
Array of
github_com_eqtylab_gateway_control-plane_service_internal_toolinventory.Toolcallsintegerdescriptionstringfirst_seen_atstringinput_schemaobjectlast_called_atstringlast_seen_atstringnamestringnamespacestringrun_bystringserverstringsourcesstring[]typestring
windowgithub_com_eqtylab_gateway_control-plane_service_internal_toolinventory.WindowShow github_com_eqtylab_gateway_control-plane_service_internal_toolinventory.Window
endstringstartstring
{
"agent_id": "string",
"correlation_id": "string",
"coverage": {
"calls_not_visible": 0,
"declared": {
"claude_code_config": "string",
"definition": "string"
},
"limits": [
"string"
],
"llm_exchanges": 0,
"tools_not_visible": 0,
"tools_read": 0,
"tools_unreadable": 0,
"unread_endpoints": [
{
"exchanges": 0,
"operation": "string",
"provider": "string"
}
]
},
"hosts": [
{
"exchanges": 0,
"host": "string",
"last_seen_at": "string",
"traffic_kind": "string"
}
],
"mcp_servers": [
{
"host": "string",
"name": "string",
"run_by": "string",
"sources": [
"string"
],
"tool_count": 0
}
],
"tool_sets": [
{
"cid": "string",
"exchanges": 0,
"first_seen_at": "string",
"last_seen_at": "string",
"tool_count": 0
}
],
"tools": [
{
"calls": 0,
"description": "string",
"first_seen_at": "string",
"input_schema": {},
"last_called_at": "string",
"last_seen_at": "string",
"name": "string",
"namespace": "string",
"run_by": "string",
"server": "string",
"sources": [
"string"
],
"type": "string"
}
],
"window": {
"end": "string",
"start": "string"
}
}400Bad Request
codestringcorrelation_idstringmessagestring
{
"code": "string",
"correlation_id": "string",
"message": "string"
}401Unauthorized
codestringcorrelation_idstringmessagestring
{
"code": "string",
"correlation_id": "string",
"message": "string"
}403Forbidden
codestringcorrelation_idstringmessagestring
{
"code": "string",
"correlation_id": "string",
"message": "string"
}404Not Found
codestringcorrelation_idstringmessagestring
{
"code": "string",
"correlation_id": "string",
"message": "string"
}500Internal Server Error
codestringcorrelation_idstringmessagestring
{
"code": "string",
"correlation_id": "string",
"message": "string"
}