Skip to content
1 minute readNewAgent-ready

Agents can end their own key and renew a webhook's signing key over MCP

Two new MCP tools: one ends the API key an agent calls with once its work is done, the other gives a webhook endpoint a new signing key. Tool descriptions now name the scopes they need.

Two things an agent could only do over plain HTTP now have MCP tools:

  • revoke_my_key revokes the API key the connection calls with, when the agent's work is done or the key may have leaked. It stops working at once, with every token exchanged from it, and it reaches no other key.
  • rotate_webhook_secret replaces a webhook endpoint's signing secret and returns the new one, once. list_webhooks shows secrets masked, so this is how an agent gets a usable one again.

The tool descriptions also say what each call needs today. The webhook tools name the webhooks:read and webhooks:write scopes, and the billing settings tools say which billing scopes change which settings.

They work in the LangChain, AI SDK and Agents SDK tool packages too.