Skip to main content
Tools are the individual capabilities exposed by your registered MCP servers. When an agent calls tools/list through the gateway, it sees the tools available in the project — filtered by the agent’s identity and policies.

​
View tools

Navigate to Tools in your project sidebar. You’ll see all tools discovered from your registered MCP servers, including:
  • Tool name — the identifier used in tools/call requests
  • Server — which MCP server provides this tool
  • Description — what the tool does
  • Input schema — the expected arguments and their types

​
How tool visibility works

Not every agent sees every tool. The gateway filters the tool list based on:
  1. Identity allowed tools — if the identity has a restricted tool list, only those tools are visible
  2. Task allowed tools — if a task session is active with its own tool list, that takes priority
  3. Policies — even if a tool is visible, the policy engine decides whether a call is actually allowed
All project tools
  └─ Filtered by identity.allowedTools (if set)
      └─ Filtered by task.allowedTools (if set, overrides identity)
          └─ Policy evaluation on each tools/call request

​
Tool naming

Tools are namespaced using the format serverName__toolName (double underscore). For example, a tool called list_issues on a server named github becomes github__list_issues. This prevents collisions when multiple MCP servers expose tools with the same name. If you have both a GitHub and a Linear server, their list_issues tools are distinct:
  • github__list_issues
  • linear__list_issues
Use the full namespaced name when referencing tools in policies, allowed tools lists, and tool calls.

​
Referencing tools in policies

Use request.tool.name with the full namespaced name in your CEL expressions: 
// Allow only specific tools
request.tool.name in ["github__get_issue", "github__list_issues", "github__add_comment"]

// Block all tools from a specific server
request.tool.name.startsWith("github__")

// Block specific tools (as a deny rule)
request.tool.name in ["stripe__delete_customer", "github__delete_repo"]

​
Next steps

Create identities

Create agent identities and restrict which tools they can see.

Write policies

Author policies that control tool access at the call level.