Can the agent reach all eight tools?
One endpoint simplifies discovery. Both OAuth hops still decide reachability.
Gateway policy manifest
Representative eight-tool manifest is ready.
One endpoint does not mean one permission boundary.
Audit the agent grant and protected-upstream token together before publishing the gateway surface.
Canonical reachability
Eight-tool OAuth map
Useful result is visible first.
0tools
0reachable
0agent blocked
0upstream blocked
0profile excess
Agent->1 MCP endpoint / 0 tools->0 upstreams
Interpretation
A route is reachable only when the agent has every gateway scope and the selected upstream token has every required protected-service scope.
Evidence boundary
This local policy audit performs no MCP handshake and verifies no token, server, package, model, or OAuth provider. Do not revoke shared-token scopes without checking other agent profiles.