How can an AI agent use your InstantDrive vault?

Last updated: 5 November 2026

What is the AI agent gateway?

MCP, the Model Context Protocol, is an open standard that lets an AI assistant call tools on another system. The InstantDrive gateway is an MCP server in front of your vault. An agent that speaks MCP, such as Claude Desktop, Cursor or an agent built with a framework, can ask it questions like "find the Ejari contract for the Sharjah office" and receive structured results, instead of someone pasting documents into a chat window.

The gateway is meant for technical teams. You need a person who can edit an MCP client configuration file and decide what an agent may see. It is not a chatbot inside InstantDrive. It is a door for software you choose to connect.

Which tools does the agent get?

The gateway lists six tools. Each one maps to one scope, which is the permission a token needs to call it.

Search and read are the two scopes most agents need. The minting form pre-selects search, read and download link. Remove what the agent does not need.

How do you give an agent access?

An admin opens the AI agent gateway panel in the app, enters an agent identifier and a display name, ticks the scopes and sets an expiry in hours. The default expiry is 720 hours, which is 30 days. The panel then shows the token once. It starts with idc_live_ and is followed by random characters.

Copy it into the agent configuration straight away. InstantDrive stores only a SHA-256 hash and the first characters of the token as a prefix for identification, so it cannot show the full token again. If you lose it, revoke it and mint a new one. The panel also shows a ready-made configuration snippet for Cursor and Claude Desktop. The gateway speaks JSON-RPC 2.0 over HTTP at /api/v1/mcp/messages, with an SSE endpoint at /api/v1/mcp/sse for clients that need it. Replace the example local address in the snippet with the address of your own InstantDrive server.

What can scopes, categories and expiry restrict?

On every tool call the policy check looks at four things in order: whether the token exists, whether it has been revoked, whether it has expired, and whether the scope the tool needs is in the token. If a call names a category, for example a search filtered to TRADE_LICENSE, the token category list is checked as well. A denied call returns an error with the reason, and the denial is written to the audit ledger.

Be precise about what this gives you. Scopes decide which tools work. Categories narrow calls that name a category, but a search without a category filter is not narrowed by the category list. The token also stores path prefixes, but the tools do not apply them today, so do not rely on paths to hide a folder. If a document must stay out of reach, do not put a wide-scope token into an agent that can query freely.

How do you revoke a token?

Each token appears in the panel list with its prefix, scopes, expiry date and state. The revoke control marks the token revoked, records the reason and the time, and updates the policy cache at once. Later calls with that token are denied as revoked, and the revocation is written to the audit ledger.

Revoking stops new calls. It cannot recall what the agent has already read, and it cannot delete what the agent or its provider stored. Link revocation to your offboarding routine for contractors and for any tool you stop using.

What does the audit ledger record?

Search, read, link, radar, dossier and denied calls each write an event to the per-company audit ledger with the actor type AI_AGENT and the agent identifier that the client sent. A read event includes the document id, path and hash. A search event includes the query text and the number of results. Because the ledger is a SHA-256 hash chain, edits to old entries show up when you run the verify check.

The ledger is tamper-evident, not write-once storage. The agent identifier is a label sent by the client, so a careless client can name itself anything. Treat the token prefix and the time as the reliable part when you investigate.

What are the security considerations?

Treat the token as a password for a user who can read your documents. Keep it in a secrets store and not in a shared chat or a repository. Use the shortest expiry that works and one token per agent, so you can revoke one without affecting the others. Choose read-only scopes first and add the download link or dossier scopes only when a workflow needs them.

Remember where the text goes. When an agent reads a document, the text enters the context of whichever AI model the agent uses. That model belongs to your agent provider, not to InstantDrive, and its data terms apply. For documents with personal data such as Emirates ID details, decide whether an external model is acceptable before you connect it. Configure your client to send the token with every request, and test that a revoked token is refused.

What does a worked example look like?

Marina Freight is a fictional logistics company. Its finance engineer wants a script that answers "which supplier contracts expire before 31 December?" every Monday. She mints a token named monday-contracts with vault:search, vault:read and vault:radar, a 90-day expiry and no download scope. She adds it to the agent configuration.

The agent calls the expiry tool for 60 days, gets a list of records with days left, then reads the stored text of the three supplier contracts and drafts a summary for the team. The ledger shows one radar event and three read events under the agent identifier. When the engineer leaves the company, the admin revokes the token in the panel and the next Monday run is refused.

What can an agent not do?

With the six tools an agent cannot upload, edit, rename, move or delete a document. It cannot create users, change tokens or see billing. It cannot sign a document, send an email or approve an expense. It reads text that InstantDrive already extracted, so a scan that was never read has no text to return, and the read tool then answers that the text is not indexed. It cannot search inside the full original file, only the stored fields and summary.

The dossier tool lists documents in a manifest, and the ZIP with Bates numbering is built by the dossier feature in the app, not by the agent. Deleted documents are excluded from every tool.

Is there a REST API with keys?

No. InstantDrive has no public REST API and no API key system. The only machine access paths are the MCP gateway tokens described here, the WebDAV drive for mounting files and the normal user sign-in. If you need to move data in bulk, use WebDAV. If you need an integration with accounting software, there is no connector today.

What does the gateway not do, and what should you do next?

It does not make an AI model safe. It limits and records what a token can ask for and leaves the model choice and its data terms to you. It does not carry certifications, and it does not claim that results are legal advice.

To start, ask your technical lead to mint one narrow token with search and read scopes and a short expiry, connect a test agent to a test set of documents, read the audit entries it creates and practise revoking it. Then decide which workflows justify wider access. Questions go through the contact page.