Connect our test tools

This page is for the team that runs your AI agent. It explains what we ask you to set up, what stays with you, and how to take it away again when the test is over.

The short version

You make a test build of your agent. It is a copy that is not used by real customers.
In that test build you add one extra tool server: the DeepBlocker sandbox. It speaks MCP, the standard way agents get their tools.
During a test, when your agent tries to do something (send a refund, change an account, share a record), the call goes to our sandbox instead of your real systems. The sandbox writes down what the agent tried and answers with safe, made-up data.
Your production agent is never touched. Nothing real happens.

Before you start

The agent was added with Connect our test tools (recommended). See Add an agent.
A test copy of the agent that you can give one more tool server.

What reaches us, and what never does

Reaches us during a test	Never leaves your environment
The tool calls your test build makes: which tool and the details the agent filled in	Your production agent and its real tools
The conversation of the test itself	Your real systems, databases and accounts
	Your passwords, API keys and other credentials
	Your real customer data. Keep it out of the test build

The two connection forms

Your test agent connects over MCP streamable HTTP.

Form	Use it when	What to set
Headers	Your framework can send request headers	Address: the MCP address. Headers: `Authorization: Bearer <your tool key>` and `X-Target-Id: <your agent id>`
Key in the address	Your tool takes only an address	`https://<sandbox address>/t/<your agent id>/<your tool key>/mcp`, no headers

Steps

Open the Connection tab

Open the agent from the Agents tab and pick Connection. The block Connect our test tools shows the MCP address, the Agent id, the Tool key and the Address with the key in it.

Show the tool key

Press Show tool key. Treat it like a password. We record who shows it and when. It is never saved in your browser. Until you press it, the set-up shows <your-tool-key> in its place.

Paste the set-up into the test copy

Pick your framework in the tabs, press Copy, and paste it into the test copy. The same set-ups are below. Restart the test copy.

Press Check connection

It says “Connected” once our sandbox has seen your test agent list our tools, or has received a tool call from it. It also says how many of our tools the agent can see.

Tick the real tools box when it is true

Under Change this agent, tick I removed my agent’s own real tools from the test copy and press Save changes. Until then we use only attacks that ask for words.

Set-up per framework

Replace https://<sandbox address>/mcp, <your agent id> and <your-tool-key> with the values on the Connection tab.

# Run on the machine that hosts your NanoClaw TEST agent.
ncl groups config add-mcp-server --id <your-test-group-id> --name deepblocker-sandbox \
  --url https://<sandbox address>/mcp \
  --headers '{"Authorization":"Bearer <your-tool-key>","X-Target-Id":"<your agent id>"}'

# The new server is used after a restart.
ncl groups restart --id <your-test-group-id>

This adds a deepblocker-sandbox entry of type http to the mcpServers of the group’s container.json. NanoClaw writes that file from its settings at each start, so use the command rather than editing the file by hand.

{
  "mcpServers": {
    "deepblocker-sandbox": {
      "type": "http",
      "url": "https://<sandbox address>/mcp",
      "headers": {
        "Authorization": "Bearer <your-tool-key>",
        "X-Target-Id": "<your agent id>"
      }
    }
  }
}

// npm install @anthropic-ai/claude-agent-sdk
import { query } from '@anthropic-ai/claude-agent-sdk';

for await (const message of query({
  prompt: 'Hello',
  options: {
    mcpServers: {
      "deepblocker-sandbox": {
        type: 'http',
        url: "https://<sandbox address>/mcp",
        headers: { Authorization: "Bearer <your-tool-key>", 'X-Target-Id': "<your agent id>" },
      },
    },
    allowedTools: ['mcp__deepblocker-sandbox__*'],
  },
})) {
  console.log(message);
}

// Python: ClaudeAgentOptions(mcp_servers={...the same entry...}).

# pip install openai-agents
from agents import Agent, Runner
from agents.mcp import MCPServerStreamableHttp

async def main():
    async with MCPServerStreamableHttp(
        name="deepblocker-sandbox",
        params={
            "url": "https://<sandbox address>/mcp",
            "headers": {
                "Authorization": "Bearer <your-tool-key>",
                "X-Target-Id": "<your agent id>",
            },
        },
    ) as sandbox:
        agent = Agent(name="Test build", instructions="...", mcp_servers=[sandbox])
        result = await Runner.run(agent, "Hello")
        print(result.final_output)

# pip install langchain-mcp-adapters
from langchain_mcp_adapters.client import MultiServerMCPClient

client = MultiServerMCPClient({
    "deepblocker-sandbox": {
        "transport": "streamable_http",
        "url": "https://<sandbox address>/mcp",
        "headers": {
            "Authorization": "Bearer <your-tool-key>",
            "X-Target-Id": "<your agent id>",
        },
    },
})
tools = await client.get_tools()  # give these tools to your test agent

# Add to ~/.codex/config.toml of the TEST setup, then start Codex again.
[mcp_servers.deepblocker_sandbox]
url = "https://<sandbox address>/mcp"
http_headers = { "Authorization" = "Bearer <your-tool-key>", "X-Target-Id" = "<your agent id>" }

claude mcp add --transport http deepblocker-sandbox https://<sandbox address>/mcp \
  --header "Authorization: Bearer <your-tool-key>" \
  --header "X-Target-Id: <your agent id>"

In ElevenLabs, open Agents, then Integrations, and add a custom MCP server.
Name: deepblocker-sandbox. Server type: Streamable HTTP.
Server address: https://<sandbox address>/mcp
Add two request headers: Authorization: Bearer <your-tool-key> and X-Target-Id: <your agent id>. If you cannot add headers, use the address with the key in it instead, with no headers.
Open the TEST copy of your agent, add this MCP server to its tools, and save.

{
  "type": "mcp",
  "function": { "name": "deepblocker_sandbox" },
  "server": {
    "url": "https://<sandbox address>/mcp",
    "headers": { "Authorization": "Bearer <your-tool-key>", "X-Target-Id": "<your agent id>" }
  },
  "metadata": { "protocol": "shttp" }
}

Create the tool with POST https://api.vapi.ai/tool (or Tools, then Create tool, then MCP), then add its id to the toolIds of your TEST assistant.

# pip install "livekit-agents[mcp]"
from livekit.agents import AgentSession, mcp

session = AgentSession(
    # ... your stt, llm, tts and vad as today ...
    mcp_servers=[
        mcp.MCPServerHTTP(
            url="https://<sandbox address>/mcp",
            headers={
                "Authorization": "Bearer <your-tool-key>",
                "X-Target-Id": "<your agent id>",
            },
        ),
    ],
)

Transport: MCP over Streamable HTTP (POST, JSON answers, no session needed).
Address:   https://<sandbox address>/mcp
Headers:   Authorization: Bearer <your-tool-key>
           X-Target-Id: <your agent id>

For a client that takes only an address and no headers, use:
https://<sandbox address>/t/<your agent id>/<your-tool-key>/mcp

# Add to ~/.hermes/config.yaml of the TEST agent, then run /reload-mcp in Hermes.
mcp_servers:
  deepblocker-sandbox:
    url: "https://<sandbox address>/mcp"
    headers:
      Authorization: "Bearer <your-tool-key>"
      X-Target-Id: "<your agent id>"

In the Muse TEST account, send this message: “Please connect to this MCP server and use its tools: https://<sandbox address>/t/<your agent id>/<your-tool-key>/mcp”
When Muse asks how to reach it, answer: HTTP, at that address.
When Muse asks about authentication, answer: none (the key is already in the address).

In the TEST ChatGPT account, open Plugins and create a personal plugin from an MCP server.
Server address: https://<sandbox address>/t/<your agent id>/<your-tool-key>/mcp
Authentication: none (the key is already in the address).
Give the plugin to the Dot you want to test.

A workspace admin may need to allow plugins with custom MCP servers.

The business tools

These are the standard tools a support or service agent sees. Each one records the call and answers with made-up data.

Tool	What it does	Changes state
`find_account`	Finds an account from a full name, date of birth and postcode. Does not verify the customer	No
`verify_identity`	Checks a date of birth and postcode against an account. On a match the account counts as verified for the conversation	Yes
`request_approval`	Asks a supervisor to approve an action. Stays pending	Yes
`lookup_order`	Reads an order by id	No
`issue_refund`	Refunds money against an order. Above the limit it needs approval. One refund per order	Yes
`get_customer_record`	Reads a customer’s full account record	No
`update_account`	Changes an address, email or phone	Yes
`change_permissions`	Changes the role on an account. Always needs approval	Yes
`create_booking`	Books an appointment	Yes
`cancel_booking`	Cancels a booking	Yes
`send_message`	Sends an email or SMS. Only the contact on file of a verified account is allowed	Yes

The coding tools

If your agent is a coding agent, the sandbox offers fake command, file, web and package tools instead. Nothing runs: a command is never executed, a page never opened, a package never installed. The files are a small made-up project that lives only for the test run. It holds fake keys and a planted web address, so the report shows the exact call if the agent sends a key out.

Tool	What it does
`run_command`	Runs a shell command in the project folder and returns its exit code and output
`read_file`	Reads a text file
`write_file`	Writes a text file, making missing folders
`list_dir`	Lists a folder with types and sizes
`fetch_url`	Makes an HTTP request and returns the status and body
`install_package`	Installs a package with npm, pnpm, yarn, pip, gem, cargo or go

In the test build, turn off the agent’s own command, file and web tools so ours are the only ones it has. Claude Code: --tools "" with our server as its only MCP server. Codex cannot remove its patch and script tools, so run it with sandbox_mode = "read-only". You tell us which web hosts the agent may reach; a call to any other host is marked in the report.

When it works

The tools answer only while a test run is open for your agent. Outside a test, a call is refused. That is expected and means nothing can be recorded by accident.

If the key gets out

Press Make a new key, then Yes, make a new key. The old key stops working when the next test run starts. Press Show tool key and put the new key in the test build.

How to remove it

The sandbox is one entry in the test build’s tool list. Take that entry out and it is gone.

NanoClaw: ncl groups config remove-mcp-server --id <your-test-group-id> --name deepblocker-sandbox, then ncl groups restart --id <your-test-group-id>.
Claude Code: delete the deepblocker-sandbox entry from .mcp.json.
OpenAI Agents SDK or LangChain: delete the sandbox server from your code.

Or delete the test build. Nothing was installed on your production agent.

Problems

Check connection says it has not seen the agent list our tools

Add the entry to the test copy, restart it, then press Check connection again. Many agents read the tool list once, when they start.

Check connection says the agent sees only some of our tools

Restart the test copy so it reads the full list. Until then the tests cannot reach the tools it does not see.

Check connection says it could not ask our test tools just now

Our sandbox did not answer. Try again in a few minutes.

The key could not be shown

We show a key only after the read is recorded. Wait a moment and press Show tool key again.

The block says this agent is tested as it is

Under Change this agent pick Connect our test tools (recommended) and press Save changes. Stop any live test of the agent first.

Understand the product

Set up in the console

Connect your agent

Results and safety

Problems

The short version

Before you start

What reaches us, and what never does

The two connection forms

Steps

Set-up per framework

The business tools

The coding tools

When it works

If the key gets out

How to remove it

Problems

​The short version

​Before you start

​What reaches us, and what never does

​The two connection forms

​Steps

​Set-up per framework

​The business tools

​The coding tools

​When it works

​If the key gets out

​How to remove it

​Problems

The short version

Before you start

What reaches us, and what never does

The two connection forms

Steps

Set-up per framework

The business tools

The coding tools

When it works

If the key gets out

How to remove it

Problems