> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cli/guides/ai-agents/limit-tools.md).

# Limit what an agent can do

Restrict the Devolutions CLI MCP server to read-only tools, hide destructive tools, keep secret values out of the model, or allow a short list of tools.

By default, `devo mcp` gives your AI client every tool it has: reading, changing, and deleting vaults and entries, managing access, and resolving secret values. Most agents need far less. Add restriction options to the `devo mcp` command in your client's configuration, and the tools you hide never reach the model.

## Pick the right option

<table><thead><tr><th width="230">CHOOSE</th><th>WHAT HAPPENS</th><th>USE IT WHEN</th></tr></thead><tbody><tr><td><code>--read-only</code></td><td>Only tools marked read-only stay. Nothing that creates, changes, moves, or deletes data.</td><td>The agent explores or reports: search entries, review access, read logs.</td></tr><tr><td><code>--deny-destructive</code></td><td>Hides tools marked destructive, such as deleting an entry, a vault, a group, a user, or variables, and restarting or stopping the background process. Tools that create or update data stay.</td><td>The agent may organize your vaults, but must not delete anything.</td></tr><tr><td><code>--deny-open-world</code></td><td>Hides tools marked as able to reach external hosts or networks. No tool the server exposes today carries that mark, so this option currently has no effect.</td><td>Your policy requires it, so the setting is already in place if such tools are added. Check what it hides with <code>devo mcp catalog</code>.</td></tr><tr><td><code>--deny-tool &#x3C;tool></code></td><td>Hides the tools you name. Repeat it for several tools.</td><td>One specific tool must never be available, such as <code>RDM_resolve_secret_reference</code>.</td></tr><tr><td><code>--allow-tool &#x3C;tool></code></td><td>Keeps <strong>only</strong> the tools you name. Repeat it for several tools.</td><td>The agent has one job and needs two or three tools.</td></tr></tbody></table>

{% hint style="warning" %}
`--deny-destructive` doesn't hide every change. Granting or revoking vault access, updating or moving entries, and creating vaults aren't marked destructive. When the agent must not change anything, use `--read-only`.
{% endhint %}

## Keep secret values out of the model

The `RDM_resolve_secret_reference` tool returns the value of a secret to your AI client. Reading a secret doesn't change your vault, so this tool is marked read-only, and `--read-only` keeps it.

To make sure no secret value reaches the model, deny it by name:

```bash
devo mcp --read-only --deny-tool RDM_resolve_secret_reference
```

When the agent needs a credential to run a tool, have it use `devo secret run` instead. The value goes to that tool only. See [Give an agent a credential without exposing it](/cli/guides/ai-agents/run-an-agent.md).

## Combine options

You can use several options together. A tool is exposed only if it passes every rule:

1. A tool named in `--deny-tool` is always hidden, even if you also name it in `--allow-tool`.
2. When you use `--allow-tool`, every tool you didn't name is hidden.
3. `--read-only`, `--deny-destructive`, and `--deny-open-world` then apply to what's left. `--allow-tool` doesn't override them: a destructive tool you allow is still hidden by `--deny-destructive`.

Tool names aren't case-sensitive. For example, to let an agent search entries and read them, and nothing else:

```bash
devo mcp --allow-tool RDM_search_entries --allow-tool RDM_get_entry
```

In your client's configuration, each option and each value is a separate item in `args`:

```json
{
  "mcpServers": {
    "devolutions": {
      "command": "devo",
      "args": ["mcp", "--read-only", "--deny-tool", "RDM_resolve_secret_reference"]
    }
  }
}
```

## Preview your configuration

`devo mcp catalog` lists the tools without starting the server, and accepts the same restriction options:

```bash
devo mcp catalog --read-only --deny-tool RDM_resolve_secret_reference --json
```

In the result, each tool shows `visible` (exposed with these options), `readOnly`, `destructive`, `openWorld`, and `sensitive`. The text output shows the first 25 exposed tools only, so use `--json` to see them all.

{% hint style="info" %}
The preview always marks `RDM_resolve_secret_reference` as hidden (`"sensitive": true`), because it leaves out the tools that return secret values. `devo mcp` started by your AI client does expose it, unless you deny it with `--deny-tool` or exclude it from `--allow-tool`. Don't rely on the preview to tell you whether secret values can reach the model: check your `--deny-tool` and `--allow-tool` options.
{% endhint %}

## Good to know

* Restrictions apply when the server starts. To change them, edit your client's configuration and restart the server from your client.
* Restrictions limit the MCP tools, not your access. The server still acts with your permissions on the workspace. For an agent that must see less, sign it in with an account or application key that has fewer permissions, in its own context. See [Switch between workspaces](/cli/guides/connect/switch-workspaces.md).
* The agent can always run `devo` commands in a shell if your client lets it. MCP restrictions don't apply to those commands. See [Give an agent a credential without exposing it](/cli/guides/ai-agents/run-an-agent.md).

## Next

* [Connect an AI client with MCP](/cli/guides/ai-agents/connect-mcp.md)
* [What stays hidden, and what doesn't](/cli/guides/understand/security-model.md)
* [Commands](/cli/reference/commands.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/cli/guides/ai-agents/limit-tools.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.