From a1eaae2b03d43c9b1d0a58370d4e6d16aafaaef0 Mon Sep 17 00:00:00 2001 From: Josh Lambert Date: Fri, 10 Apr 2026 01:02:45 -0400 Subject: [PATCH] docs(kilo-docs): consolidate MCP tool permissions into auto-approving-actions page --- .../kilo-docs/pages/automate/mcp/overview.md | 2 + .../pages/automate/mcp/using-in-cli.md | 29 +---------- .../pages/automate/mcp/using-in-kilo-code.md | 40 ++-------------- .../settings/auto-approving-actions.md | 48 +++++++++++++++++++ 4 files changed, 57 insertions(+), 62 deletions(-) diff --git a/packages/kilo-docs/pages/automate/mcp/overview.md b/packages/kilo-docs/pages/automate/mcp/overview.md index 6c04998967..8997d1434a 100644 --- a/packages/kilo-docs/pages/automate/mcp/overview.md +++ b/packages/kilo-docs/pages/automate/mcp/overview.md @@ -13,6 +13,8 @@ This documentation is organized into several sections: - [**Using MCP in Kilo Code**](using-in-kilo-code) - Comprehensive guide to configuring, enabling, and managing MCP servers with Kilo Code. Includes server settings, tool approval, and troubleshooting. +- [**MCP Tool Permissions**](/docs/getting-started/settings/auto-approving-actions#mcp-tool-permissions) - Control which MCP tools auto-approve, prompt, or are blocked entirely using the same `allow` / `ask` / `deny` permission system as built-in tools. + - [**What is MCP?**](what-is-mcp) - Clear explanation of the Model Context Protocol, its client-server architecture, and how it enables AI systems to interact with external tools. - [**STDIO & SSE Transports**](server-transports) - Detailed comparison of local (STDIO) and remote (SSE) transport mechanisms with deployment considerations for each approach. diff --git a/packages/kilo-docs/pages/automate/mcp/using-in-cli.md b/packages/kilo-docs/pages/automate/mcp/using-in-cli.md index 61b0695c11..b39f2de56c 100644 --- a/packages/kilo-docs/pages/automate/mcp/using-in-cli.md +++ b/packages/kilo-docs/pages/automate/mcp/using-in-cli.md @@ -161,34 +161,9 @@ Add the test MCP server for development: ## Tool Permissions -MCP tool calls use the same permission system as built-in tools. Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `my_server_do_something`). +MCP tools use the same permission system as built-in tools (`allow`, `ask`, `deny`). Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `my_server_do_something`). You can use glob patterns like `my_server_*` for broad rules. -There are three permission levels: - -| Permission | Behavior | -| ---------- | ----------------------------------------------------------------------------------------------------------------- | -| `"allow"` | Tool calls are auto-approved without prompting. | -| `"ask"` | A prompt appears each time the tool is called, requiring manual approval. This is the default if no rule matches. | -| `"deny"` | Tool calls are blocked entirely. | - -Add the tool name (or a wildcard pattern) to the `permission` key in your `kilo.json`: - -```jsonc -{ - "permission": { - // Auto-approve a specific tool - "my_server_safe_read": "allow", - - // Require approval for all other tools on this server - "my_server_*": "ask", - - // Block a dangerous tool entirely - "my_server_delete_all": "deny", - }, -} -``` - -Glob patterns are evaluated top-to-bottom and the first match wins. This lets you allow specific safe tools while requiring approval for everything else on a server. +For full details on configuring MCP tool permissions — including examples with glob patterns and per-tool overrides — see [Auto-Approving Actions](/docs/getting-started/settings/auto-approving-actions#mcp-tool-permissions). ## Environment Variables diff --git a/packages/kilo-docs/pages/automate/mcp/using-in-kilo-code.md b/packages/kilo-docs/pages/automate/mcp/using-in-kilo-code.md index 4611c57c48..c367179619 100644 --- a/packages/kilo-docs/pages/automate/mcp/using-in-kilo-code.md +++ b/packages/kilo-docs/pages/automate/mcp/using-in-kilo-code.md @@ -424,44 +424,14 @@ To set the maximum time to wait for a response after a tool call to the MCP serv ### Tool Permissions +MCP tools use the same permission system as built-in tools (`allow`, `ask`, `deny`). Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `my_server_do_something`). You can use glob patterns like `my_server_*` for broad rules. + +For full details on configuring MCP tool permissions — including examples with glob patterns and per-tool overrides — see [Auto-Approving Actions](/docs/getting-started/settings/auto-approving-actions#mcp-tool-permissions). + {% tabs %} -{% tab label="VSCode" %} - -MCP tool calls use the same permission system as built-in tools. Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `my_server_do_something`). - -There are three permission levels: - -| Permission | Behavior | -| ---------- | ----------------------------------------------------------------------------------------------------------------- | -| `"allow"` | Tool calls are auto-approved without prompting. | -| `"ask"` | A prompt appears each time the tool is called, requiring manual approval. This is the default if no rule matches. | -| `"deny"` | Tool calls are blocked entirely. | - -**At runtime:** When an MCP tool is called and no permission rule matches, the Permission Dock shows an approval prompt (equivalent to `"ask"`). Click **Approve Always** to save an `"allow"` rule to your config so future calls to that tool are auto-approved. - -**In your config file:** Add the tool name (or a wildcard pattern) to the `permission` key in `kilo.jsonc`: - -```jsonc -{ - "permission": { - // Auto-approve a specific tool - "my_server_safe_read": "allow", - - // Require approval for all other tools on this server - "my_server_*": "ask", - - // Block a dangerous tool entirely - "my_server_delete_all": "deny", - }, -} -``` - -Glob patterns are evaluated top-to-bottom and the first match wins, so you can allow specific safe tools while requiring approval for everything else on a server. - -{% /tab %} {% tab label="VSCode (Legacy)" %} -MCP tool auto-approval works on a per-tool basis and is disabled by default. To configure auto-approval: +In the legacy extension, MCP tool auto-approval works on a per-tool basis and is disabled by default. To configure auto-approval: 1. First enable the global "Use MCP servers" auto-approval option in [auto-approving-actions](/docs/getting-started/settings/auto-approving-actions) 2. Navigate to Settings > Agent Behaviour > MCP Servers, then locate the specific tool you want to auto-approve diff --git a/packages/kilo-docs/pages/getting-started/settings/auto-approving-actions.md b/packages/kilo-docs/pages/getting-started/settings/auto-approving-actions.md index 10e4a9d004..741a996fed 100644 --- a/packages/kilo-docs/pages/getting-started/settings/auto-approving-actions.md +++ b/packages/kilo-docs/pages/getting-started/settings/auto-approving-actions.md @@ -64,6 +64,31 @@ When a tool is set to `"ask"`, Kilo pauses and displays a permission prompt with Expand **Manage Auto-Approve Rules** to add commands or patterns to your allowed or denied lists. These rules are then appended to the bottom of the approval rules in settings and the config file. +## MCP Tool Permissions + +MCP tools use the same permission system as built-in tools. Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `my_server_do_something`). + +**At runtime:** When an MCP tool is called and no permission rule matches, the Permission Dock shows an approval prompt (equivalent to `"ask"`). Click **Approve Always** to save an `"allow"` rule to your config so future calls to that tool are auto-approved. + +**In your config file:** Add the tool name (or a wildcard pattern) to the `permission` key in `kilo.jsonc`: + +```jsonc +{ + "permission": { + // Auto-approve a specific tool + "my_server_safe_read": "allow", + + // Require approval for all other tools on this server + "my_server_*": "ask", + + // Block a dangerous tool entirely + "my_server_delete_all": "deny", + }, +} +``` + +Glob patterns are evaluated top-to-bottom and the first match wins, so you can allow specific safe tools while requiring approval for everything else on a server. + ## Defaults Most tools default to `"*": "allow"` for a smooth out-of-the-box experience. Notable exceptions that prompt by default: @@ -208,6 +233,29 @@ Most tools default to `"*": "allow"` for a smooth out-of-the-box experience. Not - **`external_directory`** — accessing files outside the project prompts for approval - **`doom_loop`** — prompts when the agent enters a repeated failure cycle +## MCP Tool Permissions + +MCP tools use the same permission system as built-in tools. Each MCP tool's permission key is its namespaced name: `{server}_{tool}` (e.g. `my_server_do_something`). + +Add the tool name (or a wildcard pattern) to the `permission` key in your `kilo.jsonc`: + +```jsonc +{ + "permission": { + // Auto-approve a specific tool + "my_server_safe_read": "allow", + + // Require approval for all other tools on this server + "my_server_*": "ask", + + // Block a dangerous tool entirely + "my_server_delete_all": "deny", + }, +} +``` + +Glob patterns are evaluated top-to-bottom and the first match wins. This lets you allow specific safe tools while requiring approval for everything else on a server. + ## Full Configuration Example {% callout type="info" %}