Skip to main content
You declared what your agent should do. Now you want to know when production behavior diverges — a new MCP tool appears, an agent starts calling deploy.release without a declaration, or a resource type you’ve never seen shows up in telemetry. Apie compares runtime tool calls against your declared capabilities and surfaces drift warnings.

​
Enable drift warnings

Configure boundary warnings in your SDK config: 
const apie = new Apie({
  agent: { key: "my-agent", name: "My Agent" },
  boundary: {
    warnOnUndeclaredTools: true,
    warnOnUnknownResourceTypes: true,
    autoInferFromToolNames: true,
  },
});
SettingWhat it detects
warnOnUndeclaredToolsTool calls for tools not in your declared capabilities
warnOnUnknownResourceTypesResource types not seen in any capability declaration
autoInferFromToolNamesInfer action/resource from tool names (helps match undeclared tools to expected patterns)

​
What drift looks like

​
Undeclared tool

Your agent calls vault.read_secret but you only declared search and github.merge_pr:
  • Apie emits the tool call event normally
  • A boundary warning is attached: tool vault.read_secret is not in declared capabilities
  • In the dashboard, the boundary map highlights the gap

​
Unknown resource type

Your agent touches shell_command but your capabilities only list code_repository and work_item:
  • A warning flags the unknown resource type
  • Guardrails may treat it as higher risk if templates match on resource type

​
What you’ll see

Boundary drift warnings in the dashboard boundary map and in event validation output from doctor.

​
Remediation workflow

  1. Monitor — run in monitor mode with drift warnings enabled
  2. Review — check which undeclared tools appear in production telemetry
  3. Declare — add missing capabilities via config or capabilities declare
  4. Enforce — enable guardrail templates and switch to Enforce mode
npx apie capabilities declare
npx apie guardrails enable prod-secrets

​
MCP auto-discovery

The MCP proxy defines tools automatically when it receives tools/list from the upstream server. This reduces drift for MCP-hosted agents — but review auto-discovered tools before enabling Enforce mode. See MCP proxy.

​
Next steps

Declare capabilities

Add missing tool declarations.

Boundary reports

Generate compliance reports over a time window.