Which one to reach for
- The agent can run a shell and is changing application code. Install the skill and let it use the SDK. Add the MCP server when the agent should also confirm what Hue stored without asking you to open the UI.
- The agent cannot run a shell, for example a hosted assistant, or you want several connected actions in one conversation (“find yesterday’s failing traces, show me the slowest span, compare the last two experiments”). Connect the MCP server.
- You are automating in CI. Use the SDK evaluation clients and the receipt endpoint directly.
Keys
Each surface uses a different key so that a leaked credential has the smallest possible blast radius:- The application’s
HUE_API_KEYis a Read and write key. It sends telemetry, modifies datasets and starts evaluation runs. - The agent’s
HUE_MCP_KEYis a Read-only key configured in the MCP client, never in application code. It cannot send or change anything, so a leaked agent key cannot alter your project.
What the agent sees
Everything the MCP server returns from your traced application is treated as data: names, generated titles, metadata and judge explanations are length-capped and labelled untrusted, recorded prompts and outputs appear only when a tool is called withinclude_content: true, and credential-shaped strings are redacted. Each result carries a link that opens the object in Hue for a signed-in member of the project.