How to Control Which MCP Tools Your AI Can Run (Allow, Audit, Approve, Deny)
Connect any decent MCP server and you get its entire tool surface: the GitHub server that reads issues also opens PRs and pushes files; the database server that runs SELECTs can often run anything. Your agent needed three tools; it got thirty. Every extra enabled tool is attack surface for prompt injection and blast radius for a confused model — and most clients give you exactly one knob: connect the server or don’t.
The fix is a per-tool policy at the gateway. On MCP Trail, every tool on every server gets one of four levels — and changing them is a dropdown, not a redeploy.
The four policy levels
- Allow — the tool runs normally (every call still logged)
- Audit-only — the call is logged with full detail but treated as policy-flagged; use it to watch a tool you’re unsure about
- Human approval (HITL) — the call pauses in the Approval queue until someone signs off
- Deny — the tool cannot run, period; it can even be hidden from the model’s tool list
Step 1: Create your free MCP Trail account and add a server
Sign up at app.mcptrail.com and add a server from the MCP Marketplace (or front your existing one).
Step 2: Open the tools policy table
Open your server under Guardian servers. The Security tab’s Access & shell section shows “Which tools may run” — every discovered tool with its current policy. The Tools tab offers the same controls with presets (e.g. read-only) to set a sane baseline in one click.
Step 3: Apply least privilege in one pass
A pattern that works for most servers:
- Deny everything your use case doesn’t need — especially deletes, bulk operations, and anything that sends data outward
- Human approval for the writes you do need — PRs, messages, updates
- Allow the read-only tools
- Audit-only for the ones you’re not sure about yet — decide after a week of logs
Step 4: Verify the deny actually denies
Ask your connected assistant to use a denied tool. It gets an explicit policy error (not a silent failure), and the attempt shows up in the Audit log — which is exactly what you want to see: evidence the gate is closed.
Where approvals land
Tools set to human approval park their calls in the Approval queue — with optional Slack alerts so reviewers don’t need the dashboard open. The agent waits; the human decides; the audit log records both.
FAQ
Does denying a tool require touching the MCP server?
No. Policies live at the gateway and apply instantly — the upstream server is unchanged, and other consumers of that server (if any) are unaffected.
Won’t the model just get confused by missing tools?
The opposite, usually: models select tools more accurately from a short, relevant list than from thirty options. Curating the surface improves both safety and quality.
Can I set policies in bulk?
Yes — policy presets apply a baseline (like read-only) across the whole server, and you adjust individual tools from there.
What happens to tool calls while I’m changing a policy?
Changes propagate within seconds. Each call is evaluated against the policy in force at that moment, and the audit log shows which decision applied.
Related Articles
- How to Block Destructive Shell Commands from AI Agents
- MCP Approvals: Human-in-the-Loop for AI Tool Calls
- How to Enforce Tool Order in MCP Sessions
- MCP Session Risk Scoring
- Threat: Tool Allowlists Without Argument Controls
Thirty tools enabled, three needed. Create your free MCP Trail account and close the gap in one pass.