Skip to main content

Manage Toolsets

Tasks

Curate named tool sets once and attach them to any binding. For the model behind Toolsets, see Toolsets.

Create a Toolset​

  1. Go to Inventory → Toolsets → New Toolset.

  2. Give it a name and description, then add tool rows. Each row names servers and tools:

    To expressServersTools
    Two tools on one servergithub-mcpget_issue, list_pull_requests
    Every read-style tool everywhere*read_*

    The drawer shows a live matches N tools count against the current inventory as you edit.

  3. Save. The Toolset appears in the library with its match count and the bindings that reference it.

Attach a Toolset to a binding​

  1. Edit an Access Binding (Setup → Settings → Access Bindings).
  2. In the Toolsets field, select one or more toolsets. Their tools join the binding's own grant.
  3. Save. The compiled-policies preview reflects the referenced toolsets' selectors — the same policies that enforce at runtime.
note

A toolset referenced by any binding — enabled or disabled — can't be deleted or renamed until you detach it: a delete must never silently shrink a grant, and disabling a binding is not enough. Remove the reference from every binding that names the toolset to free it.

Override a tool's description​

A Toolset can replace the description a tool advertises to the model — useful for normalizing verbose upstream text or masking a description that has drifted. The override is presentation-only: the tool's name, routing, policy, and audit records are unchanged. Add an override entry naming the server, the tool, and the replacement description.

Build a Toolset from usage​

  1. Go to Inventory → Toolsets and select Propose from usage.
  2. Select an agent or team, then select Create draft. For a workload in the proxy's local cluster, you can also open the workload's Policies tab and select Propose Toolset from usage to scope the draft to identities currently bound through that workload's pod UID.
  3. Review the explicit server and tool selectors in the drawer. A warning tells you when an agent or team proposal reached the newest-5,000-event bound and may omit older calls.
  4. Select Create to save. Closing the drawer saves nothing.

Attach the Toolset to a binding, then set the server's unlisted-tool posture to deny. Tools that the selected scope never used are not granted.

See also​

Last updated on