Limits

These limits are set by the user and by the user’s Vartari plan. You cannot change them from inside a session. When a call is refused for one of them, tell the user; do not look for a way around it.

DevHub serves tools only while the user is signed in and the account may run the MCP server. When the session ends, every request is answered with “sign in required”. Without a network, DevHub uses the permissions it last received, for at most 72 hours.

• Each area has a level: read, write or manage. Whether agents may reach the area over MCP is set separately.
• A tool is offered only when the account may use its area over MCP at the level the tool needs. A tool that is not offered, or is refused, names the permission it needs.
• These need the manage level: deleting files (file_delete), running scripts (npm_script_run), starting agents (agent_run) and taking screenshots (display_screenshot).
• The user can also switch single tools off in Settings. A switched-off tool is hidden and refused when called by name.

• You reach only the repositories the user registered and enabled. Paths are relative to the repository root and cannot leave it.
• You cannot run arbitrary shell commands. npm_script_run runs a script declared in the repository’s package.json, with an optional time limit.
• file_delete is irreversible. Ask the user first, unless they asked for it.
• A partial read (offset, limit, token budget) is not the whole file. Do not overwrite a file from it.
• A binary write is limited to 20 MB.
• You see the screen only through display_screenshot, and only when the user’s plan allows it.

• You see the vaults the user enabled for MCP. A vault with access “disabled” is invisible; one that is not read-write refuses writes.
• knowledge_search reads the knowledge folders only. vault_files_search reads every folder, but its index holds a vault’s first 5,000 notes.
• Take a note’s path from a listing or a search. Do not build it from a title.
• A vault says how the application behaves and why. The code settles a disagreement.

• An agent works in its own repository and in the vaults assigned to that repository, its project and its organization. Nothing else.
• An agent cannot start itself or give another agent leave to start agents.
• agent_create makes an agent that is switched off. agent_update cannot switch one on, and widening an agent’s abilities switches it off again. Only the owner switches an agent on.
• An agent cannot close an investigation.
• A run’s answer is kept for an hour.

• A step is held by one claimant. A step that touches the same files as one in progress is refused, and so is a step whose gates are not closed.
• A claim lapses if nobody renews it.
• Work in the working tree the claim gave you. Closing a step merges it back; closing as withdrawn merges nothing.

• Do not run heavy tasks in parallel when one will do. Two agents on the same files are refused for plan steps; outside plans nothing stops you from overwriting each other.
• Do not retry a refused call unchanged.
• Do not edit the files DevHub wrote into a folder (instructions, skills, configuration): the next update overwrites them.
• Do not put secrets or personal data in vault notes, investigations or log entries.
• Do not guess ids, paths or the MCP address.

• MCP server
• Plans and tiers
• Errors