List the unregistered agents

Intramedial is in restricted beta. At sign up or sign in, you have to provide the beta tester password you received or request one at preview@intramedial.com. Thank you.

Loading…

Use case

The job

Agents appear that nobody enrolled. Every call through the MCP gateway leaves a shadow event naming the DID and the tool. You read them, compare the callers with your registry, and decide what each one is.

Prerequisites

Before you start

Plan: Any plan the workspace has
Credential: A workspace API key

The code reads the key from INTRAMEDIAL_KEY. Keep it in your shell or your secret store, never in a file you commit. Calls that need a signed-in person cannot use a key: the console makes them.

Walkthrough

Steps

Send a gateway call
Route a call through the gateway as an agent nobody enrolled.

Sample output

What comes back

events holds the newest 50, each with actorDid, tool and mode.

JSON

200 OK

{
  "events": [
    {
      "at": "2026-11-01T09:14:02.118Z",
      "event": {
        : ,
        : ,
        : ,
        : 
      }
    }
  ],
  : ,
  : 
}

Evidence

What the record shows

It shows

These callers reached the MCP gateway, using these tools and modes, at these times.
An enrollment is the only decision that is stored.

It does not show

Keep going

Next steps

Modules

mcp.shadowmcp-shadow

identity.enrollidentity-enroll

Documentation

Shadow agent discovery/docs/mcp-shadow

curl -sS -X POST https://api.intramedial.com/api/v1/acp/mcp/enforce \
  -H "Authorization: Bearer $INTRAMEDIAL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "actorDid": "did:web:unknown.example:agent:scraper",
  "tool": "fs.write"
}'

const res = await fetch("https://api.intramedial.com/api/v1/acp/mcp/enforce", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    actorDid: "did:web:unknown.example:agent:scraper",
    tool: "fs.write",
  }),
});
console.log(res.status, await res.json());

import os, requests

res = requests.post(
    "https://api.intramedial.com/api/v1/acp/mcp/enforce",
    headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
    json={
        "actorDid": "did:web:unknown.example:agent:scraper",
        "tool": "fs.write",
    },
    timeout=30,
)
print(res.status_code, res.json())

Read shadow events

The route returns the newest 50 events with the DID, tool and mode. It does not say whether a caller is enrolled; compare the DIDs with the identity list to find the unknown ones.

curl -sS https://api.intramedial.com/api/v1/acp/mcp/shadow \
  -H "Authorization: Bearer $INTRAMEDIAL_KEY"

const res = await fetch("https://api.intramedial.com/api/v1/acp/mcp/shadow", {
  headers: { Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`, },
});
const body = await res.json();
for (const { at, event } of body.events) console.log(at, event.actorDid, event.tool, event.mode);

import os, requests

res = requests.get(
    "https://api.intramedial.com/api/v1/acp/mcp/shadow",
    headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
    timeout=30,
)
body = res.json()
for e in body["events"]:
    print(e["at"], e["event"]["actorDid"], e["event"]["tool"], e["event"]["mode"])

Sanction a caller

Enroll the DID as an identity with an owner and a kind. It then resolves to one agent, and its trust profile starts at 50.

curl -sS -X POST https://api.intramedial.com/api/v1/acp/identity/enroll \
  -H "Authorization: Bearer $INTRAMEDIAL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "did": "did:web:unknown.example:agent:scraper",
  "displayName": "Docs scraper",
  "kind": "partner"
}'

const res = await fetch("https://api.intramedial.com/api/v1/acp/identity/enroll", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    did: "did:web:unknown.example:agent:scraper",
    displayName: "Docs scraper",
    kind: "partner",
  }),
});
console.log(res.status, await res.json());

import os, requests

res = requests.post(
    "https://api.intramedial.com/api/v1/acp/identity/enroll",
    headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
    json={
        "did": "did:web:unknown.example:agent:scraper",
        "displayName": "Docs scraper",
        "kind": "partner",
    },
    timeout=30,
)
print(res.status_code, res.json())

Or keep it tracked

Enroll with shadow set to true to track a caller without sanctioning it. It stays visible in the list, with every call it made, and a refused caller stays visible too.

curl -sS -X POST https://api.intramedial.com/api/v1/acp/identity/enroll \
  -H "Authorization: Bearer $INTRAMEDIAL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "did": "did:web:unknown.example:agent:scraper",
  "displayName": "Docs scraper",
  "kind": "partner",
  "shadow": true
}'

const res = await fetch("https://api.intramedial.com/api/v1/acp/identity/enroll", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.INTRAMEDIAL_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    did: "did:web:unknown.example:agent:scraper",
    displayName: "Docs scraper",
    kind: "partner",
    shadow: true,
  }),
});
console.log(res.status, await res.json());

import os, requests

res = requests.post(
    "https://api.intramedial.com/api/v1/acp/identity/enroll",
    headers={"Authorization": "Bearer " + os.environ["INTRAMEDIAL_KEY"]},
    json={
        "did": "did:web:unknown.example:agent:scraper",
        "displayName": "Docs scraper",
        "kind": "partner",
        "shadow": True,
    },
    timeout=30,
)
print(res.status_code, res.json())

Agents act when the plane says yes, and the record says why.

The job

Before you start

Steps

Send a gateway call

What comes back

What the record shows

It shows

It does not show

Next steps

Modules

Documentation

Trademarks Notice

Region

Choose your language

Read shadow events

Sanction a caller

Or keep it tracked

Related recipes

Gate an agent's MCP tool call

Give an agent its own DID

Read the whole Fleet Map in a single call

New recipes by email

Try the real kernel, no key.

List the unregistered agents

Agents act when the plane says yes, and the record says why.

The job

Before you start

Steps

Send a gateway call

What comes back

What the record shows

✓It shows

×It does not show

Next steps

Modules

Documentation

Read shadow events

Sanction a caller

Or keep it tracked

Related recipes

Gate an agent's MCP tool call

Give an agent its own DID

Read the whole Fleet Map in a single call

New recipes by email

Try the real kernel, no key.

It shows

It does not show