cma-check
cma-check is a small diagnostic function, not a product surface. It uses the same
ANTHROPIC_API_KEY Edge secret cma-admin uses to probe two questions: does this org actually
have Managed Agents (CMA) enabled, and which organization does this key belong to?
Why "which org" needs probing at all
The function's demo-mode identity check works by asking whether a set of known resource IDs from
the original demo org (_cma.js's memstore_01XDuutQyFSCajiU3EpcUpG1 and
agent_01DkSQ4DMNAGsBai6k9DxFpR) still resolve. If they do, the key is still pointed at the demo
org; if they don't, it's pointed at a different one. This matters because a misconfigured key
silently pointed at the wrong org would otherwise look like CMA itself was broken.
Access and safety
Admin/lead only, verified the same way every other admin-gated function verifies a caller. It
never returns the key — only status codes and a summarized response body (counts, ids, or an
error type/message truncated to a safe length) via its internal summarize() helper.
When to use it
Run this before escalating a CMA problem as a code bug — if the key resolves to the wrong org, or
CMA isn't enabled for the resolved org at all, the fix is an account/config change, not a
cma-admin or sable-core debugging session.
Where the code lives
sable-agents-demo/supabase/functions/cma-check/index.tssable-agents-demo/web/api/_cma.js— the demo-org resource id constants this function checks against