​
What Graft is

Is Graft a catalog of integrations? No. There is no pre-built integration library and no broker behind it. When your agent needs something no tool covers, Graft’s model reads the vendor’s documentation and writes one, for you, for that need. Does Graft run inside my harness? No. Graft is an MCP server your harness connects to, with one entry in its MCP server list and a per-agent token. The only thing installed in the harness is a thin skill that tells the agent to call acquire when nothing covers the ask. Is Graft a gateway in front of my other MCP servers? No. It does not expose every tool of every app. Your agent’s list from Graft is its meta-tools plus exactly the authored tools promoted for it. Can I run two harnesses? Yes. Each is an agent with its own token, scope and working set, over one toolbox and one set of connections. Enter Gmail once and both may use it if both scopes include it.

​
Secrets

Where do I enter an API key? Never in the chat, whatever the vendor calls the value. Graft takes a secret on its own form: the one an agent’s handoff link opens, or Connections → Add connection in the console. The agent proposes hosts, scheme and parameters; the secret is yours to type. Does the model ever see my credential? No. Neither the agent’s model nor Graft’s model is given one. A module receives a short-lived capability token instead, and the proxy swaps in the real credential as the request leaves for the vendor. A vendor’s error message quoted my key. Did the agent see it? No. The proxy replaces any echoed credential value in headers and text bodies with [redacted:credential] before the response reaches the sandbox, and marks the response x-graft-redacted: credential. I lost an agent’s token. Can I see it again? No. Graft keeps only its hash. Revoke the agent on its page and create another; the old agent’s working set and history stay as your records.

​
Approvals

Why did a tool not ask before it ran? Because it only reads. A tool whose calls are all GET or HEAD publishes as read-only and never asks, which is what lets a working set grow without friction. Why did a tool ask again after I approved it? Either you set it to Ask every time for this tool, on the ask itself or on the agent’s page under Approvals, and can turn that off in the same places; or the approval was withdrawn; or the tool was republished as a write, which asks again once. A destructive tool does not ask again on its own: it asks once, like a write, and the ask says it is destructive. I pressed Allow Once in Hermes and the tool never asked again. Is that right? Yes. Any of Hermes’s allow buttons is one yes to Graft, and every tool that asks does so once by rule, destructive tools included. If you want a tool to ask before each call, turn on Ask every time for this tool in the console; no Hermes button does that. Why does a tool that only reads ask once? It was built on an SDK. The check cannot see the HTTP method inside a package, so every call into one counts as a write. The dry run shows what it actually sends. What is the build approval? acquire’s own ask, once per agent per connection. It is the moment Graft’s model starts reading your data through dry-run reads, so it asks first. Declining records nothing, and the next acquire asks again.

​
The toolbox

A tool disappeared from my agent’s list. Was it deleted? No. It was demoted, by the agent or by the cap and idle rule, and nothing is ever deleted by the system. find_tool finds it and promote brings it back in one call. The agent’s History card says which rule fired. Why did acquire refuse with connection_not_in_scope? The connection is not in that agent’s scope. Add it on the agent’s page under Scope, or let the agent propose a new connection with request_connection. Why was a package refused? It failed the package policy: not an official vendor SDK on the allowlist, and either lacking npm provenance, younger than 90 days, or under 1000 weekly downloads. A refused package is a blocked shortcut, not a blocked tool; the model writes the calls through ctx.fetch instead. What is run_tool for, if promoted tools are first-class? Two cases: the turn in which a tool was just published, before the harness has re-fetched its list, and a tool the agent wants once without promoting. It runs exactly what the first-class call runs. Does acquire block until the tool is built? No. It returns a job at once, and acquire_status reports progress. The tool appears in the list when the job succeeds; until the harness re-fetches, run_tool calls it by name.

​
Connections

Why does my Gmail connection ask me to reconnect every week? Your Google Cloud project is in Testing mode, where Google expires refresh tokens after seven days. The console shows Reconnect on the connection, and the consent runs again in a popup. Publishing the app removes the expiry and needs Google’s verification. Where does the sandbox reach? The proxy, and nothing else. Its network has no gateway and no external DNS, and npm is not there; packages install at publish.

​
Graft Cloud and self-hosting

Can I use my own model key on Graft Cloud? Yes, under Settings → Your own model key, for Anthropic, OpenAI or an OpenAI-compatible gateway. Your jobs then run on your provider. Self-hosted Graft always brings its own key and will not start without one. Graft refused to start. What now? Read docker compose logs graft. The refusal names each missing or invalid variable on its own line. The five secrets come from docker compose run --rm --no-deps graft node dist/keys.mjs >> .env; the model group is GRAFT_MODEL_BACKEND=provider, GRAFT_MODEL_PROVIDER and GRAFT_MODEL_API_KEY. See Configuration. Does docker compose down delete my tools? No. The toolbox lives in a named volume that only docker compose down -v or a volume removal touches. down also leaves the sandbox containers in place and says so. What is the licence? The core server the Docker image runs is AGPL-3.0. The skill and any harness plugin are MIT. The hosted backings are private.