Connections
Connections shows how Auga is connected and how you can use it through the terminal (CLI), the programming interface (API) and, soon, your agents (MCP). Choose a task to see how each way does it.
/v1 exist. /v1/findings and similar routes do not.What do you want to do?
| Task | CLI | API | MCP |
|---|---|---|---|
| Check that a file of runs can be analysed | ready | ready | not offered |
| Send run data to Auga | ready | ready | not offered |
| Compare the data you sent with the receipt | ready | ready | not offered |
| Read the graded findings | ready | internal | planned |
| See why we believe one finding | ready | internal | planned |
| See the runs behind a finding | ready | internal | planned |
| Investigate one incident | ready | internal | planned |
| Check if the agent is healthy | on a branch | planned | planned |
| See why an agent holds its stage | ready | internal | not offered |
| Read every agent's stage | ready | internal | not offered |
| Verify the ledger | ready | ready | not offered |
| Manage access tokens | ready | ready | not offered |
| Choose what goes to the Exchange | ready | ready | not offered |
| Read the documentation | not offered | not offered | on a branch |
CLI
readyRead the graded findings
auga find findings --dataset credit --min-grade C
Add --json to get output that scripts can read.
CLI
readyCheck that a file of runs can be analysed
auga check traces.otlp.json
The command lists which auga.* attributes exist and which are missing. It runs locally.
API
readyCheck that a file of runs can be analysed
POST https://acme.augalabs.com/api/inbox?dataset=credit&filename=traces.otlp.json
admin.Upload through the Inbox, then read the report with GET /api/inbox/{dataset}.
MCP
not offeredCheck that a file of runs can be analysed
The product plan does not include this tool. An agent is not a good way to move files.
CLI
readySend run data to Auga
auga edge send --config edge.yaml --to https://acme.augalabs.com --token-file token.txt
Only the edge at the customer organisation sends data. It applies the allowlist first.
API
readySend run data to Auga
POST https://acme.augalabs.com/v1/traces
ingest.The route accepts only OTLP/HTTP JSON. It answers 409 until the dataset's allowlist is registered.
MCP
not offeredSend run data to Auga
Only the edge sends data. We chose this on purpose.
CLI
readyCompare the data you sent with the receipt
auga edge audit --receipt https://acme.augalabs.com --since 24h
The check is green only if the tenant holds nothing that you did not send.
API
readyCompare the data you sent with the receipt
GET https://acme.augalabs.com/v1/receipt?since=24h&dataset=credit
ingest or viewer.The answer shows, for each data field, what the tenant holds.
MCP
not offeredCompare the data you sent with the receipt
The product plan does not include this tool.
API
internalRead the graded findings
GET https://acme.augalabs.com/api/graph?dataset=credit
viewer.The dashboard uses this route. It works, but the format of its answer may change. The planned contract is GET /v1/findings.
MCP
plannedRead the graded findings
list_findings
The product plan proposes this tool as a simple layer on top of the public API.
CLI
readySee why we believe one finding
auga find explain <claim> --dataset credit
The command shows the grade, the methods and each step through the evidence.
API
internalSee why we believe one finding
GET https://acme.augalabs.com/api/explain/<claim>?dataset=credit
viewer.The route returns other possible explanations and the evidence. It is not a versioned contract.
MCP
plannedSee why we believe one finding
list_findings
The task is proposed as part of the findings tool.
CLI
readySee the runs behind a finding
auga find runs <claim> --dataset credit
The command lists the runs behind a finding in the terminal.
API
internalSee the runs behind a finding
GET https://acme.augalabs.com/api/runs?dataset=credit
viewer.The route returns all runs of the dataset. The planned contract is GET /v1/runs/{pseudonym}.
MCP
plannedSee the runs behind a finding
explain_run
The tool is proposed. Trace ids need the key of the customer organisation, so the tool answers for each pseudonym.
CLI
readyInvestigate one incident
auga incident credit --window-hours 24
The command shows the deviation, the root cause, the cause chain and the fixes.
API
internalInvestigate one incident
GET https://acme.augalabs.com/api/incident?dataset=credit
viewer.The route returns the incident analysis of the latest run. The planned contract is GET /v1/incidents.
MCP
plannedInvestigate one incident
get_incident
The tool is proposed.
CLI
on a branchCheck if the agent is healthy
python -m auga.health traces.otlp.json
The command is on the branch feat/agent-health, not on main. It is not an auga subcommand yet.
API
plannedCheck if the agent is healthy
GET https://acme.augalabs.com/v1/agents/<agent>/health
The product plan includes this route. The server has no health route yet.
MCP
plannedCheck if the agent is healthy
get_agent_health
The tool is proposed.
CLI
readySee why an agent holds its stage
auga why --dataset credit --agent <agent> --field payments
The command says why the agent holds its stage, what the next stage needs and its last move between stages.
API
internalSee why an agent holds its stage
GET https://acme.augalabs.com/api/why/mandate?dataset=credit&agent=<agent>&field=payments
viewer.The route is documented, but it is not part of a versioned contract.
MCP
not offeredSee why an agent holds its stage
The proposed tools do not include this task yet. A tool for this task would fit well.
CLI
readyRead every agent's stage
auga mandate matrix --dataset credit
The command lists each agent, its field of work and its stage.
API
internalRead every agent's stage
GET https://acme.augalabs.com/api/mandate/matrix?dataset=credit
viewer.The dashboard uses this route.
MCP
not offeredRead every agent's stage
The proposed tools do not include this task yet.
CLI
readyVerify the ledger
auga ledger verify ./ledger
The command checks every signed record, hash and sequence. It needs nothing from Auga.
API
readyVerify the ledger
GET https://acme.augalabs.com/v1/tenant/ledger
viewer.The route returns the tenant's own signed record and whether it passes verification.
MCP
not offeredVerify the ledger
Verification should not depend on what an agent says.
CLI
readyManage access tokens
auga tenant token create --name "customer edge" --scopes ingest,bundle --root /var/lib/auga/tenants/acme/data
The command runs on the tenant's host. It prints the token once.
API
readyManage access tokens
POST https://acme.augalabs.com/v1/tenant/tokens
admin.The answer contains the secret once. The People and tokens page in Settings uses this route.
MCP
not offeredManage access tokens
People, not agents, manage tokens.
CLI
readyChoose what goes to the Exchange
auga exchange publish --dry-run --config exchange.yaml --dataset credit
The command lists every field path that would be published.
API
readyChoose what goes to the Exchange
PUT https://acme.augalabs.com/v1/exchange
admin.The route sets which record types this tenant may publish.
MCP
not offeredChoose what goes to the Exchange
People, not agents, decide what is shared.
CLI
not offeredRead the documentation
You need no command here. The documentation is a website.
API
not offeredRead the documentation
A tenant has no /docs or /openapi.json, on purpose. A published specification is planned.
MCP
on a branchRead the documentation
search_docs, read_page
The auga-docs server is on the branch feat/docs-mcp-server. It is not merged.
Ways to use Auga
| Way | For | How it starts | How it checks access |
|---|---|---|---|
| CLI | People and CI, at the customer organisation or on the tenant's host | The CLI is installed with the engine as the command auga. There is no public package yet. | The CLI runs where the data or keys are. Commands that reach a tenant take a token file. |
| API | Machines and the dashboard | On a tenant, every route passes through one access check (middleware) that denies by default. | Machines send Authorization: Bearer with an access token. People get a session cookie. |
| MCP | Agents that ask why | The product has no MCP server yet. A documentation server is on a branch. | Planned: the same tokens and scopes as the API. |
Systems that receive evidence from Auga
Auga records the risks and incidents of your agents. Your keeps the full list of risks for the company. Auga sends signed evidence to that system.
| Receiver | What it receives | How | Now | Systems |
|---|---|---|---|---|
| GRC system | Signed evidence about risks and incidents | Signed JSON and OSCAL export | planned | |
| Ticketing system | Changes of stage, revoked mandates and risk acceptances. A new incident would open a ticket. | Webhook with CloudEvents | partly built | |
| SIEM | The same events, for the security team | Webhook with CloudEvents, and OCSF later | partly built | |
| Model provider | An evidence package about one incident | Signed file | proposal | none listed |
| Supervisors and auditors | An evidence package that they can check without Auga | Signed file | proposal | none listed |
How Auga is connected
| Part | Where | Now |
|---|---|---|
| The guard (auga-pep) | your network | answering, and the ledger passes verification |
| The edge | your network | see the receipt |
| Identity | access tokens | single sign-on is planned |
| Documentation | docs.augalabs.com | opened by Help |
Who may do what
| Scope | For | May |
|---|---|---|
ingest | The auga-edge of the customer organisation | Send run data, register the allowlist, read the receipt |
bundle | The OPA of the customer organisation | Fetch the signed bundle and the public keys |
viewer | People | Read everything a dashboard shows |
operator | People | viewer, plus recompute, compare, compute the matrix, record reviews |
admin | Auga operations | Everything, including /v1/tenant/* |
This page is a prototype. Commands and routes were checked against the code on 6 Nov 2026. MCP tools are proposals from the product plan. The states in How Auga is connected are examples. Choose a cell in the matrix to see the command. The page uses only links and no script.
GRC system
GRC is short for governance, risk and compliance. A GRC system is the software a company uses to manage these.
GRC systems
Choose a system to read about a simulated connection. The simulation is not built.
- . A broad platform that large companies use for IT, security and compliance.
- . One of the most established platforms for risk and compliance in large companies.
- . A cloud platform for audit, risk management and SOX compliance.
- . A no-code platform where companies build their own risk and compliance processes.
- . A platform for privacy, data security, ESG and compliance.
Ticketing systems
Choose a system to read about a simulated connection. The simulation is not built.
- . A platform that large companies often use for IT tickets.
- . A ticket system from Atlassian.
- . A system that alerts the people on call.
SIEM systems
Choose a system to read about a simulated connection. The simulation is not built.
- . A widely used platform for security logs.
- . The SIEM in Microsoft Azure.
- . A SIEM for large organisations.
- . A SIEM built on the Elastic Stack.
Simulated connection to a GRC system
You could try the connection here before anyone connects a real system.
The steps
- You choose the system and a test account.
- Auga shows which data it would send, and how the data fits the fields in that system.
- Auga shows what stays in your organisation.
- Auga sends one example risk and one example incident, with signed evidence to the test account.
- You see the receipt, and you can check the signature.
Now
This flow is not built. Auga has not been tried with this system.
Simulated connection to a ticketing system
You could try the connection here before anyone connects a real system.
The steps
- You choose the system and a test account.
- Auga shows which data it would send, and how the data fits the fields in that system.
- Auga shows what stays in your organisation.
- Auga sends a ticket for one example incident to the test account.
- You see the receipt, and you can check the signature.
Now
This flow is not built. Auga has not been tried with this system.
Simulated connection to a SIEM
You could try the connection here before anyone connects a real system.
The steps
- You choose the system and a test account.
- Auga shows which data it would send, and how the data fits the fields in that system.
- Auga shows what stays in your organisation.
- Auga sends one example security event to the test account.
- You see the receipt, and you can check the signature.
Now
This flow is not built. Auga has not been tried with this system.