runloop_api_client 1.30.0__tar.gz → 1.31.0__tar.gz

runloop_api_client-1.31.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.31.0"
+}

{runloop_api_client-1.30.0 → runloop_api_client-1.31.0}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [1.31.0](https://github.com/runloopai/api-client-python/compare/v1.30.0...v1.31.0) (2026-08-25)
+
+
+### Features
+
+* initial stlc build ([9591d74](https://github.com/runloopai/api-client-python/commit/9591d741d3e840a7f7eadb0935989af1ea78d337))
+* **mux:** mint agent gateway tokens for running devboxes ([#10872](https://github.com/runloopai/api-client-python/issues/10872)) ([8ca74f9](https://github.com/runloopai/api-client-python/commit/8ca74f9390524e2b99791a6967dd8e355df0cff8))
+* **mux:** mint MCP tokens for running devboxes ([#10871](https://github.com/runloopai/api-client-python/issues/10871)) ([7edf2e9](https://github.com/runloopai/api-client-python/commit/7edf2e9daa607705070df22c02d3e95a1fb13a60))
+
+
+### Bug Fixes
+
+* **lint:** sort the devboxes import block ([22bc6c2](https://github.com/runloopai/api-client-python/commit/22bc6c22f41c0db8b50df3f264e47e9b6b5e1e11))
+* **release:** use stable versioning instead of prerelease ([3d2cf64](https://github.com/runloopai/api-client-python/commit/3d2cf6463a9556dcc0bb2eddc397e5d2bdf7d69b))
+
+
+### Chores
+
+* sync uv.lock to 1.30.0 ([d7d2993](https://github.com/runloopai/api-client-python/commit/d7d29930aa3a460d9a0dac9651860b11292c8769))
+
 ## 1.30.0 (2026-08-20)
 
 Full Changelog: [v1.29.0...v1.30.0](https://github.com/runloopai/api-client-python/compare/v1.29.0...v1.30.0)

{runloop_api_client-1.30.0 → runloop_api_client-1.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: runloop_api_client
-Version: 1.30.0
+Version: 1.31.0
 Summary: The official Python library for the runloop API
 Project-URL: Homepage, https://github.com/runloopai/api-client-python
 Project-URL: Repository, https://github.com/runloopai/api-client-python

{runloop_api_client-1.30.0 → runloop_api_client-1.31.0}/api.md

@@ -214,6 +214,8 @@ from runloop_api_client.types import (
     DevboxSnapshotListView,
     DevboxSnapshotView,
     DevboxView,
+    GatewayTokenView,
+    McpTokenView,
     PtyTunnelView,
     TunnelView,
     DevboxCreateSSHKeyResponse,
@@ -228,6 +230,8 @@ Methods:
 - <code title="get /v1/devboxes/{id}">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">retrieve</a>(id) -> <a href="./src/runloop_api_client/types/devbox_view.py">DevboxView</a></code>
 - <code title="post /v1/devboxes/{id}">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">update</a>(id, \*\*<a href="src/runloop_api_client/types/devbox_update_params.py">params</a>) -> <a href="./src/runloop_api_client/types/devbox_view.py">DevboxView</a></code>
 - <code title="get /v1/devboxes">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">list</a>(\*\*<a href="src/runloop_api_client/types/devbox_list_params.py">params</a>) -> <a href="./src/runloop_api_client/types/devbox_view.py">SyncDevboxesCursorIDPage[DevboxView]</a></code>
+- <code title="post /v1/devboxes/{id}/create_gateway_token">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">create_gateway_token</a>(id, \*\*<a href="src/runloop_api_client/types/devbox_create_gateway_token_params.py">params</a>) -> <a href="./src/runloop_api_client/types/gateway_token_view.py">GatewayTokenView</a></code>
+- <code title="post /v1/devboxes/{id}/create_mcp_token">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">create_mcp_token</a>(id, \*\*<a href="src/runloop_api_client/types/devbox_create_mcp_token_params.py">params</a>) -> <a href="./src/runloop_api_client/types/mcp_token_view.py">McpTokenView</a></code>
 - <code title="post /v1/devboxes/{id}/create_pty_tunnel">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">create_pty_tunnel</a>(id) -> <a href="./src/runloop_api_client/types/pty_tunnel_view.py">PtyTunnelView</a></code>
 - <code title="post /v1/devboxes/{id}/create_ssh_key">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">create_ssh_key</a>(id) -> <a href="./src/runloop_api_client/types/devbox_create_ssh_key_response.py">DevboxCreateSSHKeyResponse</a></code>
 - <code title="post /v1/devboxes/disk_snapshots/{id}/delete">client.devboxes.<a href="./src/runloop_api_client/resources/devboxes/devboxes.py">delete_disk_snapshot</a>(id) -> object</code>

{runloop_api_client-1.30.0 → runloop_api_client-1.31.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "runloop_api_client"
-version = "1.30.0"
+version = "1.31.0"
 description = "The official Python library for the runloop API"
 dynamic = ["readme"]
 license = "MIT"

{runloop_api_client-1.30.0 → runloop_api_client-1.31.0}/release-please-config.json

@@ -2,11 +2,11 @@
   "packages": {
     ".": {}
   },
-  "$schema": "https://raw.githubusercontent.com/stainless-api/release-please/main/schemas/config.json",
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
   "include-v-in-tag": true,
   "include-component-in-tag": false,
-  "versioning": "prerelease",
-  "prerelease": true,
+  "versioning": "default",
+  "prerelease": false,
   "bump-minor-pre-major": true,
   "bump-patch-for-minor-pre-major": false,
   "pull-request-header": "Automated Release PR",

{runloop_api_client-1.30.0 → runloop_api_client-1.31.0}/src/runloop_api_client/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "runloop_api_client"
-__version__ = "1.30.0"  # x-release-please-version
+__version__ = "1.31.0"  # x-release-please-version

{runloop_api_client-1.30.0 → runloop_api_client-1.31.0}/src/runloop_api_client/resources/devboxes/devboxes.py

@@ -31,11 +31,13 @@ from ...types import (
     devbox_enable_tunnel_params,
     devbox_execute_async_params,
     devbox_snapshot_disk_params,
+    devbox_create_mcp_token_params,
     devbox_wait_for_command_params,
     devbox_read_file_contents_params,
     devbox_list_disk_snapshots_params,
     devbox_snapshot_disk_async_params,
     devbox_write_file_contents_params,
+    devbox_create_gateway_token_params,
 )
 from ..._files import deepcopy_with_paths
 from ..._types import Body, Omit, Query, Headers, NotGiven, FileTypes, omit, not_given
@@ -91,7 +93,9 @@ from ...lib.polling_async import async_poll_until
 from ...types.devbox_view import DevboxView
 from ...types.tunnel_view import TunnelView
 from ...lib.wait_for_status import wait_for_status, async_wait_for_status
+from ...types.mcp_token_view import McpTokenView
 from ...types.pty_tunnel_view import PtyTunnelView
+from ...types.gateway_token_view import GatewayTokenView
 from ...types.shared_params.mount import Mount
 from ...types.devbox_snapshot_view import DevboxSnapshotView
 from ...types.shared.launch_parameters import LaunchParameters as SharedLaunchParameters
@@ -608,6 +612,126 @@ class DevboxesResource(SyncAPIResource):
             model=DevboxView,
         )
 
+    def create_gateway_token(
+        self,
+        id: str,
+        *,
+        gateway: str,
+        secret: str,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+        idempotency_key: str | None = None,
+    ) -> GatewayTokenView:
+        """
+        Mint a token that lets a running Devbox call an external API through the Runloop
+        agent gateway, using the credential in the supplied secret. The gateway applies
+        the credential to proxied requests, so the real API key is never exposed to the
+        Devbox.
+
+        The token is bound to this Devbox and is only accepted for requests that
+        originate from it. Nothing is stored on the Devbox: the token is returned to the
+        caller and is not re-issued when the Devbox is resumed.
+
+        Args:
+          gateway: The gateway config to use. Can be a gateway config ID (gwc_xxx) or name.
+
+          secret: The secret containing the credential. Can be a secret ID or name.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+
+          idempotency_key: Specify a custom idempotency key for this request
+        """
+        if not id:
+            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        return self._post(
+            path_template("/v1/devboxes/{id}/create_gateway_token", id=id),
+            body=maybe_transform(
+                {
+                    "gateway": gateway,
+                    "secret": secret,
+                },
+                devbox_create_gateway_token_params.DevboxCreateGatewayTokenParams,
+            ),
+            options=make_request_options(
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                idempotency_key=idempotency_key,
+            ),
+            cast_to=GatewayTokenView,
+        )
+
+    def create_mcp_token(
+        self,
+        id: str,
+        *,
+        mcp_config: str,
+        secret: str,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+        idempotency_key: str | None = None,
+    ) -> McpTokenView:
+        """
+        [Beta] Mint a token that lets a running Devbox reach an upstream MCP (Model
+        Context Protocol) server through the Runloop MCP hub, using the credential in
+        the supplied secret. Tool access is limited to the MCP config's allowed_tools,
+        and the credential itself is never exposed to the Devbox.
+
+        The token is bound to this Devbox and is only accepted for requests that
+        originate from it. Nothing is stored on the Devbox: the token is returned to the
+        caller and is not re-issued when the Devbox is resumed.
+
+        Args:
+          mcp_config: The MCP config to use. Can be an MCP config ID (mcp_xxx) or name.
+
+          secret: The secret containing the MCP server credential. Can be a secret ID or name.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+
+          idempotency_key: Specify a custom idempotency key for this request
+        """
+        if not id:
+            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        return self._post(
+            path_template("/v1/devboxes/{id}/create_mcp_token", id=id),
+            body=maybe_transform(
+                {
+                    "mcp_config": mcp_config,
+                    "secret": secret,
+                },
+                devbox_create_mcp_token_params.DevboxCreateMcpTokenParams,
+            ),
+            options=make_request_options(
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                idempotency_key=idempotency_key,
+            ),
+            cast_to=McpTokenView,
+        )
+
     def create_pty_tunnel(
         self,
         id: str,
@@ -2324,6 +2448,126 @@ class AsyncDevboxesResource(AsyncAPIResource):
             model=DevboxView,
         )
 
+    async def create_gateway_token(
+        self,
+        id: str,
+        *,
+        gateway: str,
+        secret: str,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+        idempotency_key: str | None = None,
+    ) -> GatewayTokenView:
+        """
+        Mint a token that lets a running Devbox call an external API through the Runloop
+        agent gateway, using the credential in the supplied secret. The gateway applies
+        the credential to proxied requests, so the real API key is never exposed to the
+        Devbox.
+
+        The token is bound to this Devbox and is only accepted for requests that
+        originate from it. Nothing is stored on the Devbox: the token is returned to the
+        caller and is not re-issued when the Devbox is resumed.
+
+        Args:
+          gateway: The gateway config to use. Can be a gateway config ID (gwc_xxx) or name.
+
+          secret: The secret containing the credential. Can be a secret ID or name.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+
+          idempotency_key: Specify a custom idempotency key for this request
+        """
+        if not id:
+            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        return await self._post(
+            path_template("/v1/devboxes/{id}/create_gateway_token", id=id),
+            body=await async_maybe_transform(
+                {
+                    "gateway": gateway,
+                    "secret": secret,
+                },
+                devbox_create_gateway_token_params.DevboxCreateGatewayTokenParams,
+            ),
+            options=make_request_options(
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                idempotency_key=idempotency_key,
+            ),
+            cast_to=GatewayTokenView,
+        )
+
+    async def create_mcp_token(
+        self,
+        id: str,
+        *,
+        mcp_config: str,
+        secret: str,
+        # Use the following arguments if you need to pass additional parameters to the API that aren't available via kwargs.
+        # The extra values given here take precedence over values defined on the client or passed to this method.
+        extra_headers: Headers | None = None,
+        extra_query: Query | None = None,
+        extra_body: Body | None = None,
+        timeout: float | httpx.Timeout | None | NotGiven = not_given,
+        idempotency_key: str | None = None,
+    ) -> McpTokenView:
+        """
+        [Beta] Mint a token that lets a running Devbox reach an upstream MCP (Model
+        Context Protocol) server through the Runloop MCP hub, using the credential in
+        the supplied secret. Tool access is limited to the MCP config's allowed_tools,
+        and the credential itself is never exposed to the Devbox.
+
+        The token is bound to this Devbox and is only accepted for requests that
+        originate from it. Nothing is stored on the Devbox: the token is returned to the
+        caller and is not re-issued when the Devbox is resumed.
+
+        Args:
+          mcp_config: The MCP config to use. Can be an MCP config ID (mcp_xxx) or name.
+
+          secret: The secret containing the MCP server credential. Can be a secret ID or name.
+
+          extra_headers: Send extra headers
+
+          extra_query: Add additional query parameters to the request
+
+          extra_body: Add additional JSON properties to the request
+
+          timeout: Override the client-level default timeout for this request, in seconds
+
+          idempotency_key: Specify a custom idempotency key for this request
+        """
+        if not id:
+            raise ValueError(f"Expected a non-empty value for `id` but received {id!r}")
+        return await self._post(
+            path_template("/v1/devboxes/{id}/create_mcp_token", id=id),
+            body=await async_maybe_transform(
+                {
+                    "mcp_config": mcp_config,
+                    "secret": secret,
+                },
+                devbox_create_mcp_token_params.DevboxCreateMcpTokenParams,
+            ),
+            options=make_request_options(
+                extra_headers=extra_headers,
+                extra_query=extra_query,
+                extra_body=extra_body,
+                timeout=timeout,
+                idempotency_key=idempotency_key,
+            ),
+            cast_to=McpTokenView,
+        )
+
     async def create_pty_tunnel(
         self,
         id: str,
@@ -3578,6 +3822,12 @@ class DevboxesResourceWithRawResponse:
         self.list = to_raw_response_wrapper(
             devboxes.list,
         )
+        self.create_gateway_token = to_raw_response_wrapper(
+            devboxes.create_gateway_token,
+        )
+        self.create_mcp_token = to_raw_response_wrapper(
+            devboxes.create_mcp_token,
+        )
         self.create_pty_tunnel = to_raw_response_wrapper(
             devboxes.create_pty_tunnel,
         )
@@ -3677,6 +3927,12 @@ class AsyncDevboxesResourceWithRawResponse:
         self.list = async_to_raw_response_wrapper(
             devboxes.list,
         )
+        self.create_gateway_token = async_to_raw_response_wrapper(
+            devboxes.create_gateway_token,
+        )
+        self.create_mcp_token = async_to_raw_response_wrapper(
+            devboxes.create_mcp_token,
+        )
         self.create_pty_tunnel = async_to_raw_response_wrapper(
             devboxes.create_pty_tunnel,
         )
@@ -3776,6 +4032,12 @@ class DevboxesResourceWithStreamingResponse:
         self.list = to_streamed_response_wrapper(
             devboxes.list,
         )
+        self.create_gateway_token = to_streamed_response_wrapper(
+            devboxes.create_gateway_token,
+        )
+        self.create_mcp_token = to_streamed_response_wrapper(
+            devboxes.create_mcp_token,
+        )
         self.create_pty_tunnel = to_streamed_response_wrapper(
             devboxes.create_pty_tunnel,
         )
@@ -3875,6 +4137,12 @@ class AsyncDevboxesResourceWithStreamingResponse:
         self.list = async_to_streamed_response_wrapper(
             devboxes.list,
         )
+        self.create_gateway_token = async_to_streamed_response_wrapper(
+            devboxes.create_gateway_token,
+        )
+        self.create_mcp_token = async_to_streamed_response_wrapper(
+            devboxes.create_mcp_token,
+        )
         self.create_pty_tunnel = async_to_streamed_response_wrapper(
             devboxes.create_pty_tunnel,
         )

{runloop_api_client-1.30.0 → runloop_api_client-1.31.0}/src/runloop_api_client/types/__init__.py

@@ -32,6 +32,7 @@ from .scenario_view import ScenarioView as ScenarioView
 from .axon_list_view import AxonListView as AxonListView
 from .benchmark_view import BenchmarkView as BenchmarkView
 from .blueprint_view import BlueprintView as BlueprintView
+from .mcp_token_view import McpTokenView as McpTokenView
 from .agent_list_view import AgentListView as AgentListView
 from .axon_event_view import AxonEventView as AxonEventView
 from .mcp_config_view import McpConfigView as McpConfigView
@@ -52,6 +53,7 @@ from .axon_create_params import AxonCreateParams as AxonCreateParams
 from .benchmark_job_view import BenchmarkJobView as BenchmarkJobView
 from .benchmark_run_view import BenchmarkRunView as BenchmarkRunView
 from .devbox_list_params import DevboxListParams as DevboxListParams
+from .gateway_token_view import GatewayTokenView as GatewayTokenView
 from .object_list_params import ObjectListParams as ObjectListParams
 from .pty_connect_params import PtyConnectParams as PtyConnectParams
 from .pty_control_params import PtyControlParams as PtyControlParams
@@ -140,6 +142,7 @@ from .scoring_function_result_view import ScoringFunctionResultView as ScoringFu
 from .scenario_definition_list_view import ScenarioDefinitionListView as ScenarioDefinitionListView
 from .scoring_contract_update_param import ScoringContractUpdateParam as ScoringContractUpdateParam
 from .blueprint_build_logs_list_view import BlueprintBuildLogsListView as BlueprintBuildLogsListView
+from .devbox_create_mcp_token_params import DevboxCreateMcpTokenParams as DevboxCreateMcpTokenParams
 from .devbox_create_ssh_key_response import DevboxCreateSSHKeyResponse as DevboxCreateSSHKeyResponse
 from .devbox_wait_for_command_params import DevboxWaitForCommandParams as DevboxWaitForCommandParams
 from .devbox_read_file_contents_params import DevboxReadFileContentsParams as DevboxReadFileContentsParams
@@ -148,6 +151,7 @@ from .devbox_list_disk_snapshots_params import DevboxListDiskSnapshotsParams as
 from .devbox_snapshot_disk_async_params import DevboxSnapshotDiskAsyncParams as DevboxSnapshotDiskAsyncParams
 from .devbox_write_file_contents_params import DevboxWriteFileContentsParams as DevboxWriteFileContentsParams
 from .devbox_async_execution_detail_view import DevboxAsyncExecutionDetailView as DevboxAsyncExecutionDetailView
+from .devbox_create_gateway_token_params import DevboxCreateGatewayTokenParams as DevboxCreateGatewayTokenParams
 from .devbox_read_file_contents_response import DevboxReadFileContentsResponse as DevboxReadFileContentsResponse
 from .benchmark_run_list_scenario_runs_params import (
     BenchmarkRunListScenarioRunsParams as BenchmarkRunListScenarioRunsParams,

runloop_api_client-1.31.0/src/runloop_api_client/types/devbox_create_gateway_token_params.py

@@ -0,0 +1,15 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Required, TypedDict
+
+__all__ = ["DevboxCreateGatewayTokenParams"]
+
+
+class DevboxCreateGatewayTokenParams(TypedDict, total=False):
+    gateway: Required[str]
+    """The gateway config to use. Can be a gateway config ID (gwc_xxx) or name."""
+
+    secret: Required[str]
+    """The secret containing the credential. Can be a secret ID or name."""

runloop_api_client-1.31.0/src/runloop_api_client/types/devbox_create_mcp_token_params.py

@@ -0,0 +1,15 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Required, TypedDict
+
+__all__ = ["DevboxCreateMcpTokenParams"]
+
+
+class DevboxCreateMcpTokenParams(TypedDict, total=False):
+    mcp_config: Required[str]
+    """The MCP config to use. Can be an MCP config ID (mcp_xxx) or name."""
+
+    secret: Required[str]
+    """The secret containing the MCP server credential. Can be a secret ID or name."""

runloop_api_client-1.31.0/src/runloop_api_client/types/gateway_token_view.py

@@ -0,0 +1,33 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from .._models import BaseModel
+from .shared.auth_mechanism import AuthMechanism
+
+__all__ = ["GatewayTokenView"]
+
+
+class GatewayTokenView(BaseModel):
+    token: str
+    """The token to send to the gateway as a Bearer token in the Authorization header.
+
+    Only accepted for requests originating from the bound Devbox.
+    """
+
+    auth_mechanism: AuthMechanism
+    """How the gateway applies the credential to proxied requests."""
+
+    devbox_id: str
+    """The Devbox the token is bound to."""
+
+    endpoint: str
+    """The target API endpoint the gateway proxies to."""
+
+    gateway_config_id: str
+    """The ID of the gateway config the token proxies through."""
+
+    url: str
+    """The gateway URL to send requests to.
+
+    Matches the value of the {prefix}\\__URL environment variable inside the
+    Devbox.
+    """

runloop_api_client-1.31.0/src/runloop_api_client/types/mcp_token_view.py

@@ -0,0 +1,33 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import List
+
+from .._models import BaseModel
+
+__all__ = ["McpTokenView"]
+
+
+class McpTokenView(BaseModel):
+    token: str
+    """The token to send to the MCP hub as a Bearer token in the Authorization header.
+
+    Only accepted for requests originating from the bound Devbox.
+    """
+
+    allowed_tools: List[str]
+    """Glob patterns for the tools the token permits."""
+
+    devbox_id: str
+    """The Devbox the token is bound to."""
+
+    endpoint: str
+    """The upstream MCP server endpoint the hub proxies to."""
+
+    mcp_config_id: str
+    """The ID of the MCP config the token grants access to."""
+
+    url: str
+    """The MCP hub URL the token authenticates against.
+
+    Matches the RL_MCP_URL environment variable inside the Devbox.
+    """