# Agents > The Agents screen: create an agent and get its token once, set its scope, cap and idle window, and read its working set, approvals and history. Source: https://docs.getgraft.ai/graft/console/agents Each harness that connects to Graft is an agent, with a token, a scope and a working set of its own. **Agents** is where you make one and where you read what it has been doing. Your connections and your toolbox are yours across every agent; what an agent holds is which connections it may use and which tools are in its list right now. ## The list The Agents screen lists every agent you have created, grouped into *Active* and *Revoked*, with seven columns: the name, its **Harnesses**, its **Token** prefix, its **Working set** as a count against the cap, its **Idle window**, when it was created and its status. The full token is never here. An agent that [Claude or ChatGPT](https://docs.getgraft.ai/graft/harnesses/claude-and-chatgpt.md) connected shows the product's name in the Harnesses column and **OAuth** in the Token column: the product holds its tokens, so there is no prefix. An agent made in the console records no harness, so its Harnesses cell reads **Set up harness** while it is active; it is a prompt that opens the setup, not a report on whether the harness is connected. Each row's actions menu offers **View agent**, **Connect a harness** and **Edit** (the name, cap and idle window in a dialog). **New agent** opens the creation dialog. ## Creating an agent ### Step 1: Name, limits and scope Give the agent a name that says where the harness runs and which one it is, such as `laptop Hermes`. The **Working-set cap** and **Idle window (days)** default to 20 and 21; they drive the rule that contracts the agent's list, and you can change them later. Under **Scope**, tick the connections this agent may use. Its tools cannot reach a connection outside the scope, and you can change it any time. Then **Create agent**. ### Step 2: Copy the token The dialog shows the token once. Under it, the MCP server URL and a **Harness** choice, Hermes first, then two blocks in that harness's own shape: where the token goes (`~/.hermes/.env` for Hermes, `~/.openclaw/.env` for OpenClaw, an `export GRAFT_TOKEN='grft_…'` line for any other client) and what to add to its configuration (`mcp_servers` in YAML for Hermes, `mcp.servers` for OpenClaw's Gateway, the generic `mcpServers` block otherwise). Graft keeps only the token's hash, so copy it before you close the dialog with **I have copied the token**. If it is lost, revoke the agent and create another. ### Step 3: Paste the block into your harness The configuration block carries no secret. It names `${GRAFT_TOKEN}`, which the harness resolves from its `.env` file or its environment, so the block can live in a config file you commit. The [Hermes](https://docs.getgraft.ai/graft/harnesses/hermes.md) and [OpenClaw](https://docs.getgraft.ai/graft/harnesses/openclaw.md) pages carry the same blocks with the hosted URL. ## An agent's page Click an agent's name, or **View agent** in its row's menu, to open its page. The header shows the token prefix, when it was created and its status, with **Connect a harness** and **Revoke token** on the right. Below are five cards. **Connect a harness** opens the same setup the creation dialog showed, for this deployment's origin: the URL, the harness choice and the two blocks. The token is not in it; the token line carries a placeholder for the one you saved, and Graft cannot show it again. The button is absent on a revoked agent. For an agent a product connected the dialog gives the URL and says to choose this agent under **Connect as** at the product's consent: there is nothing to paste, and revoking the agent is how the connection ends. **Scope** is the set of connections the agent may use, as checkboxes over your connections. **Save scope** replaces the set in one step, in effect on the agent's next call: the capability token minted for its next run names exactly these connections. An `acquire` against a connection outside the scope is refused as `connection_not_in_scope` and points the agent at `request_connection`, which proposes a new connection for you to confirm; an existing connection is added here. **Name, cap and idle window** holds the two knobs of the contraction rule, plus the name; **Edit** in the agents list opens the same three fields as a dialog. A tool unused past the idle window is demoted; when more than the cap are promoted, the least recently used go first, never one used inside the window, and never while the agent has a run in flight. **Save** takes effect at the next sweep. The cap accepts 1 to 500 and the window 1 to 3650 days. **Working set** is the agent's tool list as the harness sees it, counted against the cap. Each row shows the tool's wire name and description, an **Asks** column showing its read-only, write or destructive badge, who promoted it (*the agent*, *a publish* or *the rule*), when, and when it was last used. **Approvals** is your standing answers for this agent, per tool: *allowed* or *denied*, when you decided, and whether the tool asks every time. The **Asks every time** switch works both ways on any allowed tool, write or destructive: on, the tool asks you before each call; off, your answer holds. **Withdraw** removes the answer, so the tool asks again on its next call, and is the way back from a no. Approvals are per agent, so the same tool can be allowed for one of your agents and denied for another. **History** lists every promotion and demotion with its cause, newest first: *the agent asked*, *published by the agent*, *unused past the idle window*, *over the working-set cap*, or *its connection was revoked*. ## Revoking **Revoke token** stops the token resolving at the MCP endpoint at once; the harness is refused from then on, and the token cannot be restored. The agent's row, working set and history stay as your records. To reconnect the harness, create a new agent and paste the new token. One token is one agent, so a leaked token costs you one agent and nothing else. On an agent a product connected the button reads **Revoke agent** and revokes the tokens the product holds; the product then asks you to connect again. Revoking a connection is a different act, done under **Connections**, and it reaches every agent at once. See [Managing and revoking](https://docs.getgraft.ai/graft/connections/managing-and-revoking.md). ## Prompts to try ```text List the tools in your working set and demote the ones you do not need for this job. ``` ```text Find a tool for Xero invoices. If it is not promoted, promote it. ``` ## Where next - [Agents and persons](https://docs.getgraft.ai/graft/concepts/agents-and-persons.md): Why connections belong to you and scopes belong to an agent. - [Promote and demote](https://docs.getgraft.ai/graft/toolbox/promote-and-demote.md): The cap and idle rule the History card records.