IndyKite Developer Hub logo
Back to all guides
MCP

Use IndyKite from your AI coding agent

Install the IndyKite skills bundle so Claude Code, Gemini CLI, and other coding agents can author ContX IQ policies, call the MCP server, and deploy Agent Gateway against your project - from a single prompt.

The indykite/skills repo packages IndyKite’s core developer workflows as skills - bundles of instructions a coding agent loads on demand. After install, your agent can author CIQ policies, initialise MCP sessions, and deploy IAG against your project from a single prompt.

Verified end-to-end with Claude Code and Gemini CLI. The skills CLI also drops files into the right place for Cursor, Aider, Continue, and any other agent it supports - automatic activation in those agents depends on the agent.

What your agent can do after install

Each row is a real prompt the matching skill is designed to handle. After install, paste the prompt into your agent - the skill activates automatically based on the prompt’s wording.

You ask your agent… Skill that handles it
“Expose Person-OWNS-Car as a parameterised read query.” indykite-ciq-read
“Create a new Track node in the IKG with title and loudness.” indykite-ciq-create-node
“Add a PLAYED_AT relationship between an existing Track and Venue.” indykite-ciq-create-relationship
“Create a new Contract and atomically link it to an existing Vehicle and Person.” indykite-ciq-create-node-with-link
“Let a Person update their own music_mood property.” indykite-ciq-add-property
“Annotate a PLAYED_AT relationship with a verified flag.” indykite-ciq-add-relationship-property
“Clear the music_mood property from a Person - GDPR erase.” indykite-ciq-delete
“Author a KBAC policy letting a Person PROVISION a Server only when they are MEMBER_OF a Team that OWNS it, publish it as ACTIVE, then deactivate the old provisioning policy.” indykite-authzen-kbac-policies
“Can ada PROVISION gpu-node-7 with max_budget 120000 passed as an input param? Gate the deploy step on the live decision and explain a false.” indykite-authzen-evaluation
“In one batch call, check for ada, grace, and linus which of DEPLOY and RESTART each may perform on gpu-node-7, and give me the allow/deny grid.” indykite-authzen-evaluations
“Which actions is linus allowed to perform on gpu-node-7? I want to render only the permitted buttons in the admin UI.” indykite-authzen-search-action
“List every Server that ada can PROVISION so we can prefill the target dropdown with only her permitted machines.” indykite-authzen-search-resource
“Who can APPROVE the document contract-2043? Produce the reviewer list for the quarterly access audit.” indykite-authzen-search-subject
“Build the Capture payload to ingest three Person employees with verified email properties - source, assurance level, and verification time metadata - routing emma to the east location.” indykite-capture-upsert-nodes
“Link each imported Person to their Department with a MEMBER_OF relationship carrying a since property; the cross-location edges go to the global database.” indykite-capture-upsert-relationships
“Prepare the delete payload that removes all the seeded qa-* test Person nodes from the IKG in one batch.” indykite-capture-delete-nodes
“GDPR erasure request: strip the email and phone properties from person-millicent but keep the node and its relationships intact.” indykite-capture-delete-node-properties
“Remove the assurance_level and verified_time metadata from millicent’s email property - the value stays, the provenance goes.” indykite-capture-delete-node-property-metadata
“Contract ended: delete the CAN_DRIVE relationship between ryan and kitt without touching either node.” indykite-capture-delete-relationships
“Drop the status and renewal_date properties from the OWNS edge between knightrider and kitt; the relationship itself must survive.” indykite-capture-delete-relationship-properties
“Initialise an MCP session against eu.mcp.indykite.com and call authzen_evaluate.” indykite-mcp-server
“Deploy IAG in front of my three A2A agents and wire up the workflow in the IKG.” indykite-agent-gateway

Full skill catalog (hosted on this site)

Every skill is also hosted on this site, verbatim. If your agent cannot install skills, point it at a skill’s SKILL.md URL below (or at the machine-readable index at /api/skills.json) and it can follow the instructions in-context — the relative links to each skill’s references/ and scripts/ resolve on this site too.

22 skills, served verbatim from https://github.com/indykite/skills. Each skill is a self-contained instruction bundle: fetch its SKILL.md and follow the relative links (references/, scripts/) for the full workflow. Machine index: /api/skills.json. Install into a coding agent with npx skills add indykite/skills.

Agent Gateway

Skill What it does
indykite-agent-gateway Deploy and configure IndyKite Agent Gateway (IAG) in front of agent-to-agent (A2A) workflows or MCP servers.

AuthZEN / KBAC

Skill What it does
indykite-authzen-evaluation Make a single KBAC authorization decision via the IndyKite AuthZEN REST API (POST /access/v1/evaluation) - returns a boolean decision for one (subject, action, resource) triple, optionally with per-request `contex…
indykite-authzen-evaluations Run many KBAC authorization decisions in one call via the IndyKite AuthZEN REST API (POST /access/v1/evaluations), with top-level subject/action/resource/context as defaults overridden per entry; returns one `decisi…
indykite-authzen-kbac-policies Author and manage an IndyKite KBAC (Knowledge-Based Access Control) authorization policy - a single subject type, an actions list, a single resource type, and a Cypher condition over the IKG - through the Config API (…
indykite-authzen-search-action List the actions a subject is allowed to perform on a resource via the IndyKite AuthZEN REST API (POST /access/v1/search/action) - returns the granted action names for one pinned (subject, resource) pair.
indykite-authzen-search-resource List the resources a subject is allowed to perform a given action on via the IndyKite AuthZEN REST API (POST /access/v1/search/resource) - given a subject and an action, returns the matching resource instances of a …
indykite-authzen-search-subject List the subjects allowed to perform a given action on a resource via the IndyKite AuthZEN REST API (POST /access/v1/search/subject) - given a resource and an action, returns the matching subject instances of a type.

Capture API

Skill What it does
indykite-capture-delete-node-properties Build the request-body JSON for the IndyKite Capture API batch node-property delete (POST /capture/v1/nodes/properties/delete) - a nodes array (1-250 per request) where each entry names a node (external_id + `ty…
indykite-capture-delete-node-property-metadata Build the request-body JSON for the IndyKite Capture API batch property-metadata delete (POST /capture/v1/nodes/properties/metadata/delete) - a nodes array (1-250 per request) where each entry names a node (`exter…
indykite-capture-delete-nodes Build the request-body JSON for the IndyKite Capture API batch node delete (POST /capture/v1/nodes/delete) - a nodes array (1-250 per request) of {external_id, type} references, each removing one whole node from…
indykite-capture-delete-relationship-properties Build the request-body JSON for the IndyKite Capture API batch relationship-property delete (POST /capture/v1/relationships/properties/delete) - a relationships array (1-250 per request), each entry identifying a …
indykite-capture-delete-relationships Build the request-body JSON for the IndyKite Capture API batch relationship delete (POST /capture/v1/relationships/delete) - a relationships array (1-250 per request), each entry identifying a relationship by `sou…
indykite-capture-upsert-nodes Build the request-body JSON for the IndyKite Capture API batch node upsert (POST /capture/v1/nodes) - a nodes array (1-250 per request) of entities, each with external_id, type, optional is_identity / `label…
indykite-capture-upsert-relationships Build the request-body JSON for the IndyKite Capture API batch relationship upsert (POST /capture/v1/relationships) - a relationships array (1-250 per request), each entry connecting a source node to a target …

ContX IQ

Skill What it does
indykite-ciq-add-property Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that sets one or more properties on an existing node in the IndyKite Graph (IKG), then run it via POST /contx-iq/v1/execute.
indykite-ciq-add-relationship-property Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that sets one or more properties on an existing relationship in the IndyKite Graph (IKG), then run it via POST /contx-iq/v1/execute.
indykite-ciq-create-node Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that creates a brand-new node in the IndyKite Graph (IKG), then run it via POST /contx-iq/v1/execute.
indykite-ciq-create-node-with-link Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that creates a brand-new node AND links it to one or more existing nodes via new relationships in a single POST /contx-iq/v1/execute call.
indykite-ciq-create-relationship Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that creates a brand-new relationship between two existing nodes in the IndyKite Graph (IKG), then run it via POST /contx-iq/v1/execute.
indykite-ciq-delete Author an IndyKite ContX IQ (CIQ) policy plus its Knowledge Query that deletes a node, a relationship, or one or more properties from the IndyKite Graph (IKG), then run it via POST /contx-iq/v1/execute.
indykite-ciq-read Author a read-only IndyKite ContX IQ (CIQ) policy plus its Knowledge Query, then run it via POST /contx-iq/v1/execute.

MCP Server

Skill What it does
indykite-mcp-server Make live IndyKite authorization decisions (AuthZEN/KBAC) and run ContX IQ graph queries from an AI agent over the Model Context Protocol - one Bearer-token JSON-RPC session, no bespoke REST wiring.

Prerequisites

  • An IndyKite project. Create one with POST /configs/v1/projects or via the IndyKite Terraform provider.
  • A coding agent - Claude Code, Gemini CLI, or any other agent the skills CLI supports.
  • Node.js on your PATH so npx can run the CLI.

Install

One line, into every agent the CLI detects on your machine:

npx skills add indykite/skills

Restart the agent so it picks up the new skill directory, then verify:

npx skills list

Cherry-pick a single skill

If you only need one capability - say CIQ reads - install just that one:

npx skills add indykite/skills --skill indykite-ciq-read --agent claude-code

Bundle install (Claude Code or Gemini CLI)

For agents with a plugin marketplace, the bundle registers every skill at once and prompts for credentials at install time.

Claude Code:

/plugin marketplace add indykite/skills
/plugin install indykite-skills

Gemini CLI:

gemini extensions install https://github.com/indykite/skills

Try it: your first prompt

After install + restart, paste this into your agent:

Initialise an MCP session against eu.mcp.indykite.com for my project and list the available tools.

The indykite-mcp-server skill should activate and walk the agent through mcp/initialize, header construction, and the tools/list call. If it doesn’t activate, see Troubleshooting below.

Credentials

Skills read connection details from environment variables - or, if you used Bundle install, from the prompts you answered at install time. You’ll need a subset depending on which skills you use:

Variable What it is Where to get it
API_URL IndyKite REST base URL for your region https://eu.api.indykite.com or https://us.api.indykite.com
API_KEY AppAgent token (sent as X-IK-ClientKey) POST /configs/v1/application-agent-credentials, or indykite_application_agent_credential in the Terraform provider
BEARER_TOKEN User OAuth access token Standard IndyKite OAuth flow. Required for Person-subject CIQ flows and MCP session init
SERVICE_ACCOUNT_TOKEN Service-account token with Config API write access From Hub UI, through the Config REST API or the Terraform provider.
MCP_URL IndyKite MCP base URL https://eu.mcp.indykite.com or https://us.mcp.indykite.com. Used by indykite-mcp-server only
PROJECT_GID IndyKite project identifier Returned in the response of POST /configs/v1/projects, or fetch later via GET /configs/v1/projects

API_KEY, BEARER_TOKEN, and SERVICE_ACCOUNT_TOKEN are secrets. Don’t commit them, don’t paste them into chat transcripts, and scope them down where possible.

Troubleshooting

A skill doesn’t activate

  1. It’s installed. Run npx skills list. If the skill name isn’t there, reinstall with --agent <your-agent>.
  2. The prompt fits the description. Each SKILL.md has a description and ## When to use. If your prompt is vague, rephrase it toward the wording there.
  3. No conflicting skill. If two skills could plausibly handle the same prompt, the agent picks one. Disambiguate by invoking the skill explicitly - /<skill-name> in Claude Code, or your agent’s equivalent.

A CIQ or MCP call returns 401 / 403

  • API_KEY is the AppAgent token, not a user token.
  • BEARER_TOKEN (when required) is fresh - IndyKite OAuth tokens are short-lived.
  • PROJECT_GID matches the project the credentials belong to.

The indykite-mcp-server skill has a dedicated debugging path for MCP 401s; ask the agent about it directly.

Updating to a new release

npx skills add installs symlinks by default, so a git pull in your local copy (or rerunning the install command) picks up new content. Restart the agent after.

Reference