Capability parity

How Vergio proves that first-party agent capabilities remain reachable with scoped customer credentials.

Vergio does not give its first-party agent a private customer capability. Every customer-affecting capability used by an executable published playbook must also be reachable with an appropriately scoped customer API key or OAuth grant. Internal composition may reduce cost or latency, but it cannot reveal a capability, datum, or price that the scoped customer surface cannot obtain.

The release audit reads the real REST route source, the real MCP handler registry, the registered tool modules, and the commercial and playbook manifests. It also checks that each declared scope is enforced by the handler. Dashboard wallet funding remains explicitly human-only. A future operation may remain in a versioned compatibility manifest only when its machine availability is explicit and the related guide does not claim the playbook is executable. The current Monday Opportunity Briefing therefore names two unavailable compatibility operations but clearly blocks execution; it is not an exception that gives the first-party agent private access.

Every customer-affecting capability the first-party agent uses is reachable by an appropriately scoped customer key. Internal composition is allowed only for cost or latency, never to expose a capability, datum, or price a scoped key cannot obtain.

Audit w80-s6-v1: fail. Scope enforcement: pass.

Built and reachable

  • mcp:add_client_watches using write:watch
  • mcp:add_deal_note using write:deals
  • mcp:add_self_directed_watches using write:watch
  • mcp:cancel_managed_watch using write:watch
  • mcp:create_contact using write:contacts
  • mcp:create_deal using write:deals
  • mcp:create_webhook using manage:webhooks
  • mcp:delete_webhook using manage:webhooks
  • mcp:enroll_in_cadence using write:outreach
  • mcp:find_contacts using write:contacts
  • mcp:get_account_evidence using read:accounts
  • mcp:get_account_signals using read:accounts
  • mcp:get_balance using read:wallet
  • mcp:get_client_watch_brief using read:watch
  • mcp:get_client_watches using read:watch
  • mcp:get_outreach_stats using read:accounts
  • mcp:get_pipeline_summary using read:accounts
  • mcp:get_runway using read:wallet
  • mcp:get_tool_receipt using read:accounts
  • mcp:get_usage using read:wallet
  • mcp:get_watch_contract using read:watch
  • mcp:get_watch_receipt using read:watch
  • mcp:inspect_prices using read:wallet
  • mcp:list_approvals using read:wallet
  • mcp:list_cadences using read:accounts
  • mcp:list_contacts using read:accounts
  • mcp:list_deals using read:accounts
  • mcp:list_in_market_accounts using read:accounts
  • mcp:list_standing_rules using read:wallet
  • mcp:list_watch_events using read:watch
  • mcp:list_webhooks using manage:webhooks
  • mcp:move_deal_stage using write:deals
  • mcp:read_managed_watch using read:watch
  • mcp:read_self_directed_watches using read:watch
  • mcp:read_watch_health using read:watch
  • mcp:record_outcome using write:outcomes
  • mcp:remove_client_watches using write:watch
  • mcp:remove_self_directed_watches using write:watch
  • mcp:request_report using generate:reports
  • mcp:resize_managed_watch using write:watch
  • mcp:search_accounts using read:accounts
  • mcp:set_account_status using write:deals
  • mcp:stop_enrollment using write:outreach
  • mcp:update_contact using write:contacts
  • mcp:update_deal using write:deals
  • rest:DELETE /api/v1/client-watches using write:watch
  • rest:DELETE /api/v1/contacts/[id] using write:contacts
  • rest:DELETE /api/v1/deals/[id] using write:deals
  • rest:DELETE /api/v1/enrollments/[id] using write:outreach
  • rest:DELETE /api/v1/managed-watch using write:watch
  • rest:DELETE /api/v1/self-directed-watches using write:watch
  • rest:DELETE /api/v1/webhooks/[id] using manage:webhooks
  • rest:GET /api/v1/accounts using read:accounts
  • rest:GET /api/v1/accounts/[storeId] using read:accounts
  • rest:GET /api/v1/accounts/[storeId]/contacts using read:accounts
  • rest:GET /api/v1/accounts/[storeId]/signals using read:accounts
  • rest:GET /api/v1/approvals using read:wallet
  • rest:GET /api/v1/cadences using read:accounts
  • rest:GET /api/v1/client-watches using read:watch
  • rest:GET /api/v1/client-watches/[storeId]/brief using read:watch
  • rest:GET /api/v1/deals using read:accounts
  • rest:GET /api/v1/enrollments using read:accounts
  • rest:GET /api/v1/lists/current using read:accounts
  • rest:GET /api/v1/managed-watch using read:watch
  • rest:GET /api/v1/managed-watch/contract using read:watch
  • rest:GET /api/v1/managed-watch/events using read:watch
  • rest:GET /api/v1/managed-watch/health using read:watch
  • rest:GET /api/v1/managed-watch/receipt using read:watch
  • rest:GET /api/v1/pipeline/summary using read:accounts
  • rest:GET /api/v1/self-directed-watches using read:watch
  • rest:GET /api/v1/standing-rules using read:wallet
  • rest:GET /api/v1/wallet/balance using read:wallet
  • rest:GET /api/v1/wallet/pricing.json using read:wallet
  • rest:GET /api/v1/wallet/usage using read:wallet
  • rest:GET /api/v1/webhooks using manage:webhooks
  • rest:PATCH /api/v1/contacts/[id] using write:contacts
  • rest:PATCH /api/v1/deals/[id] using write:deals
  • rest:PATCH /api/v1/managed-watch using write:watch
  • rest:POST /api/v1/accounts/[storeId]/contacts using write:contacts
  • rest:POST /api/v1/accounts/[storeId]/find-contacts using write:contacts
  • rest:POST /api/v1/accounts/[storeId]/status using write:deals
  • rest:POST /api/v1/cadences/[id]/enrollments using write:outreach
  • rest:POST /api/v1/client-watches using write:watch
  • rest:POST /api/v1/deals using write:deals
  • rest:POST /api/v1/deals/[id]/notes using write:deals
  • rest:POST /api/v1/deals/[id]/stage using write:deals
  • rest:POST /api/v1/outcomes using write:outcomes
  • rest:POST /api/v1/reports using generate:reports
  • rest:POST /api/v1/self-directed-watches using write:watch
  • rest:POST /api/v1/webhooks using manage:webhooks

Explicitly human-only

  • dashboard:approvals:createStandingRuleAction
  • dashboard:approvals:revokeStandingRuleAction
  • dashboard:billing:resumeWalletFundingMode
  • dashboard:billing:saveWalletFundingSettings
  • dashboard:billing:startWalletManualFunding
  • dashboard:wallet.ceiling.raise
  • dashboard:wallet.commitment.change
  • dashboard:wallet.funding.approve

Declared future

    Updated July 28, 2026

    Is this page helpful?