Control MCP tool access
Allow or deny tool calls by MCP server and tool.
New organizations start with a seeded Allow all rule, so an agent can call every tool on every MCP server you add. Agent Access rules narrow that to the servers and tools each agent, user, or group should reach.
How a rule matches a tool call
The gateway checks active rules from top to bottom, and the first rule that matches decides the call.
If no rule matches, the call is denied.
The MCP pill limits a rule to tools from specific MCP servers, or to every server that carries a resource tag.
The Tools pill takes patterns such as send_*, or an exact tool name such as read_file.
A pattern with no * matches only that exact name, so check the tool names on the resource's page before you write one.
A tool your rules deny is left out of the agent's tool list, not only blocked when the agent calls it.
Limit what a call can send
A condition on request.args checks the arguments of each tool call, such as a Slack channel or a GitHub branch.
For example, mcp.slug == "slack" && request.args.channel_id in ["C_GENERAL", "C_DEVREL"] limits a rule to two Slack channels.
Make a server read-only
An allow rule only adds access, so read-only access takes two rules.
Put an Allow rule for list_*, get_*, search_*, and read_* above a Deny rule for * on the servers you lock down.
A rule change applies on each agent's next connection.
For conditions, rule order, and more patterns, see Agent Access.