MCP Tools element
The MCP Tools element attaches OPA policy bindings to individual tools exposed on an MCP surface. It is available on MCP surfaces only and can appear once per surface. When any tool entries are configured, the element activates allowlist enforcement automatically: a tools/call request for an unlisted tool is denied without any additional toggle.
The tool entry list acts as an allowlist when non-empty. A tools/call for a tool with no matching entry is denied. No additional toggle is required to activate enforcement.
Fields
Each row in the tool entry list configures one tool.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| Tool name | string | Yes | — | Name of the MCP tool this policy applies to. Must match the tool name exactly as defined in the MCP server or proxy. |
| Policy Definition | string | Yes | — | ID of the OPA policy definition in the policy store. Evaluated at tools/call time with the McpPolicyContext input schema. |
| Description | string | No | — | Human-readable note shown in the dashboard. Has no runtime effect. |
Related
- Control MCP tool access with per-tool policies: step-by-step guide to adding tool policies to a surface.
- OPA policies reference: the
McpPolicyContextinput schema used when this element evaluates a policy. - Managed Agent reference: where to add the element on the canvas.
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.