For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Use AccessPolicies to control which agents can invoke MCP server tools.

Before you begin

Follow the quickstart guide to install Solo Enterprise for agentregistry and deploy your first agent. The quickstart also sets up Keycloak as an OIDC provider and creates an admin user that you use to create AccessPolicies in this guide.

Restrict MCP tool access

By default, any deployed agent can invoke all tools on an MCP server. To restrict an agent to access only specific tools at runtime, you create an AccessPolicy resource.

1. Create an AccessPolicy that allows the myagent agent to access the echo MCP tool of the mymcp MCP server. The mymcp server comes with two tools, an echo and sum tool. Because the sum tool is not listed in the AccessPolicy, access to the tool is denied.

   cat <<EOF | arctl apply -f -
   apiVersion: ar.dev/v1alpha1
   kind: AccessPolicy
   metadata:
     name: access-myagent-mymcp
   spec:
     description: Allow the myagent agent to invoke the echo MCP server tool, but not the sum tool at runtime.
     principals:
       - kind: Deployment
         name: myagent
     rules:
       - actions:
           - runtime:invoke
         resources:
           - kind: server
             name: mymcp
             subresources:
               - tool/example_echo
   EOF

   Example output:

   ✓ AccessPolicy/access-myagent-mymcp created
   

2. Open the Instances view in the UI and select the myagent agent.

3. In the Agent Details card, click Open Chat.

4. Chat with the agent and ask it what it can do for you. Then, hit Enter and wait for the agent to reply. Verify that the agent lists the built-in tools (roll-die and check-prime) and the example_echo tool from the MCP server. The example_sum MCP tool is not shown, because you allowed access to only the example_echo tool.

   

   

Other configurations

Review other common configuration examples.

Allow all tool access

Allow the myagent agent to invoke all tools that are hosted on the everything MCP server, but restrict access to other MCP servers.

arctl apply -f- <<EOF
apiVersion: ar.dev/v1alpha1
kind: AccessPolicy
metadata:
  name: access-policy
spec:
  description: "Runtime access policy"
  principals:
    - kind: Deployment
      name: myagent  
  rules:
    - actions:
        - "runtime:invoke"   
      resources:
        - kind: server
          name: everything
EOF