Refresh, reconnect, and update an agent

All agent connection guides

Recovery and removal

Authorization requests expire after 15 minutes. Rerun the same command to resume or renew a pending request. Accepted reports can be safely retried after a lost response. Do not run the same local connection profile concurrently.

Reporting credentials expire after 90 days. Choose Reconnect agent from its detail page, or use --renew with the existing local profile. Browser approval replaces the old reporting credential while preserving the agent identity. If local state is lost, use the detail page's reconnect prompt instead of creating a new agent.

Disconnect reporting stops future inventory reports and preserves the last inventory. For hosted MCP, it also revokes delegated Library and Gateway calls. Separately issued Gateway bearer credentials remain unchanged. Archiving the Library agent disables both reporting and any explicitly linked Gateway credential. Removing or demoting the administrator who authorized Team reporting revokes that reporting connection; a current administrator can reconnect it.

An expired, revoked, or archived connection cannot report. Use Refresh status to check server state. A received report indicates the last successful receipt, not continuous connectivity or runtime protection.

Review adoption and Gateway activity

Open an agent in Library to review its last report, files served through the connector, reported fingerprints, and attributed Gateway activity. These are separate evidence sources:

• Declared dependencies record the versions someone associated with the agent.
• File served confirms Foo Guard returned that exact retained copy through MCP.
• Reported in latest inventory means the agent reported a matching kind and retained fingerprint. It does not prove installation or execution.
• Observed Gateway activity counts calls routed with that agent's authenticated identity. It does not reveal which config or skill caused a call.

Team file status shows whether a delivered version is retired and whether a newer published, non-retired version of the same Library item is available. Review changes before adopting a replacement; a newer version is not automatically safer. Personal Library copies show archive status. Matching filenames alone do not establish a version relationship.

Overview highlights matching reported files that are archived, retired, or have a newer published Team version. It checks up to 25 recently updated active agents and 200 recent deliveries and displays up to five notices. No notices does not establish complete coverage or deployment safety. Each notice links to the agent and includes the report date.

Gateway activity shows the latest 100 retained requests from the last seven days. Personal OAuth-routed calls record the Library agent identity prospectively; earlier calls and shared direct credentials remain unattributed. Team credentials without a linked Library identity are excluded. Reporting disconnection does not erase historical evidence. If a status cannot be loaded, use Refresh status; Foo Guard shows it as unavailable rather than zero.

Keep inventory current

Agent detail labels inventory reports older than 24 hours as Inventory needs refresh. This is an evidence-age threshold, not proof the agent is offline. A hosted MCP tool call can verify the connection without updating its inventory. Disconnected, expired and never-reported states are shown separately.

For a local agent, choose Report selected files every 15 minutes in Connect agent. After initial authorization, preview the exact relative filenames with --file, approve recurring metadata updates, and add --approve-metadata --watch 900 when rerunning the same profile. The process rereads only the selected files, including their changing hashes. It never discovers more files or sends contents. Stop with Ctrl+C; no background service is installed. A missing file, revoked/expired credential or request failure stops reporting. Resolve the error and rerun; a pending unacknowledged report is retried unchanged before the next fresh report. Use --renew only when browser authorization is needed.

Hosted Claude cannot watch local files. Ask it to report only metadata you explicitly choose to share using the available inventory tool, then refresh the agent page. Do not infer that it can see files elsewhere on your machine or that a reported fingerprint proves execution.

Review an adoption update

On a Team agent's Library adoption table, Review update appears when a newer published, non-retired version of the same item exists. The dialog shows both retained copies side by side and their checksums. Retired or otherwise unavailable copies stay unavailable for delivery; compare against your existing local copy instead. Review the version's scan findings in Library before proceeding.

Copy update prompt binds the request to that workspace, agent and exact version. The agent must check its identity, verify the retained checksum and ask before changing local files. Hosted clients must explain when they cannot install locally. Copying the prompt never installs anything.

After an actual approved update and inventory report, refresh the page. Target fingerprint reported means the latest reported hash and file kind match a delivery of the target copy. Identical content in different versions cannot establish which version was installed. Modified copies won't match; a report is not proof of execution. Personal copies do not have inferred version lineage, so no automatic replacement is suggested.

Add a Library file to an existing agent

Open the agent’s detail page and choose Add to agent. Select an existing config or skill, or upload a new copy into the selected workspace. Review the exact retained content and its scan history before copying client setup instructions. Instructions pin the workspace, agent, file ID, and retained checksum, and stop if the connected client reports a different identity.

Team owners and administrators can inspect unpublished drafts without publishing them. A draft, blocked version, or unsupported skill remains review-only in this flow; use its Library settings to resolve configuration publication and policy requirements. Retired content must be restored before inspection. Review does not grant distribution access. Other members can still retrieve versions allowed by the existing availability gate.

For an available version, approve the intended local destination before an agent changes files. Hosted clients may require manual setup. Downloads and setup prompts do not confirm installation. Team administrators may separately record the exact version as a declared dependency. Refresh the agent page to see delivery receipts or explicitly reported inventory.

The Needs attention panel highlights connection, stale inventory, available updates, unavailable files, and retained Gateway concerns. These are follow-up actions based on loaded evidence, not a new security score. Declared, Delivered, Reported by agent, and Observed through Gateway describe different evidence and never prove one another.

Review changes and finish setup

Agent details show new, changed and removed definitions from the workspace’s last Gateway discovery. These notices describe the workspace server, not proof that this agent used a tool. Review definitions in Library Tools and approve changes in Gateway. Existing Library adoption notices link to newer published versions and exact-version comparisons before updating an agent.

The Overview setup checklist tracks a current agent connection with accepted reporting or remote connection evidence, a saved Library item, a saved scan and an active Gateway connection. Unknown evidence does not count as complete. Refresh Overview after setup; completed steps do not establish runtime safety or a policy pass.