Integrations

MCP Tool Policies

Allow, review, or block each tool an agent can invoke on a remote MCP server. The per-tool counterpart to scope policies.

Policy decisions

Allow: The call proceeds immediately. Suits read-only tools like list_contacts.
Review: The call pauses until you approve or deny it. The prompt shows the server name, the tool being called (send_email), and a plain-language description of the action ("Allow sending email via CRM Server?"). The agent waits up to 5 minutes; with no response, the call times out and the agent receives an error.
Block: The call is rejected and the agent receives a policy error. Suits tools like delete_all_records.

Resolution order

The first rule that exists wins:

Explicit tool policy: a rule for the specific tool name, such as send_email set to review.
MCP default: the server-level default (the * entry in the policy editor).
Global default: the fallback from user settings. The factory default is review.

Protocol methods are exempt

Policy enforcement applies only to tools/call requests. Protocol-level methods always pass, so discovery and connection management work regardless of policy settings:

initialize and notifications/initialized (handshake)
tools/list, prompts/list, resources/list (discovery)
ping, logging/setLevel, completion/complete (housekeeping)
All notifications/* methods

Configuring tool policies

In the policy editor

Open Settings > Connections and select the MCP server to open its detail page.
Open the policy editor. It shows the MCP default and every discovered tool with its name, description, and current policy. Filter tools by name or description with the search box, or by decision with the dropdown.
Set each tool to Allow, Review, Block, or Default, then save.

From a review prompt

Review prompts appear inline in the session. Alongside approve and deny, Always allow sets an explicit allow policy for that tool, building up policies incrementally during normal use.

Audit trail

Every tool call is recorded in the MCP audit log:

Field	Description
`agentSlug`	The agent that made the call
`remoteMcpId`	The MCP server ID
`remoteMcpName`	The MCP server display name
`method`	The HTTP method (typically POST)
`requestPath`	The JSON-RPC method (`tools/call: search_contacts`)
`statusCode`	The upstream response status
`durationMs`	Round-trip time in milliseconds
`policyDecision`	The outcome: `allow`, `approved_by_user`, `denied_by_user`, `block`, or `review_timeout`
`matchedTool`	The tool name for `tools/call` requests

Protocol-level methods are recorded with a decision of allow since they bypass enforcement. See Audit Logging for the full trail.

Comparison with scope policies

	Scope policies	Tool policies
Applies to	Connected accounts (OAuth APIs)	Remote MCP servers
Granularity	Per OAuth scope (`gmail.send`)	Per tool name (`send_email`)
Default hierarchy	Scope, then risk label, then account, then global	Tool, then server, then global
Multiple matches	Most permissive scope wins	Single tool match

Remote MCP Servers: Registering and managing MCP servers.
Scope Policies: The equivalent system for connected accounts.