Capability registry
A capability registry is a single definition of what an agent can do inside a product (invite a teammate, change a plan, download an invoice), defined once and rendered two ways: as cursor motion for human users and as typed MCP tools for their AI agents. Neither surface is maintained separately.
Why define capabilities once?
Because a duplicated definition drifts. If the cursor's version of "change plan" and the agent's tool version live in different places, one updates and the other rots. A single registry means a capability's permissions, confirmation copy and effect string are identical whether a person or an agent invokes it.
How do agents get the same permissions as users?
Each capability carries the scope of the user who invoked it. An agent connected to a user's endpoint inherits exactly that user's permissions, never more, and every call states its effect before it runs. The registry is the enforcement point, so there is no separate agent-permission model to keep in sync.