For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Use AccessPolicy to control which kagent agent deployments can invoke MCP server tools.

Before you begin

Deploy an agent and MCP server to Solo Enterprise for kagent.

• Deploy a BYO agent
• Deploy an MCP server

Restrict MCP tool access

By default, any deployed agent can invoke all tools on an MCP server. To restrict an agent to access only specific tools at runtime, create an AccessPolicy resource. When applied, Solo Enterprise for agentregistry fans the policy out to kagent as a Kubernetes AccessPolicy CRD, which agentgateway enforces at the waypoint proxy level.

1. Create an AccessPolicy that allows your agent to access specific MCP server tools. The following example allows the myagent deployment to access the example_echo tool of the mymcp MCP server. The mymcp server comes with two tools, example_echo and example_sum. Because example_sum is not listed, access to it is denied.

   arctl apply -f - <<EOF
   apiVersion: ar.dev/v1alpha1
   kind: AccessPolicy
   metadata:
     name: myagent-mymcp-echo
   spec:
     description: Allow myagent to invoke example_echo on mymcp.
     principals:
       - kind: Deployment
         name: myagent
     rules:
       - actions:
           - runtime:invoke
         resources:
           - kind: server
             name: mymcp
             subresources:
               - tool/example_echo
   EOF

   Example output:

   ✓ AccessPolicy/myagent-mymcp-echo created
   

   Field	Description
   spec.principals[].kind	Set to Deployment to identify the calling agent deployment.
   spec.principals[].name	The name of the agent deployment whose outbound access this policy grants.
   spec.rules[].actions	The operations to authorize. Set to runtime:invoke to allow tool calls.
   spec.rules[].resources[].kind	The target type. Use server for catalog MCP servers.
   spec.rules[].resources[].name	The name of the target MCP server. Use "*" to match all servers.
   spec.rules[].resources[].subresources	Optional. A list of specific tool names the agent may call, prefixed with tool/. Omit to allow all tools on the target server.

2. Verify that the policy was propagated to kagent as a Kubernetes AccessPolicy CRD. Solo Enterprise for agentregistry names each propagated CRD using the pattern ar-<policyName>-r<ruleIndex>-res<resourceIndex>.

   kubectl -n kagent get accesspolicy ar-myagent-mymcp-echo-r0-res0 -o yaml

   Note

   The CRD may take a few seconds to appear. Fan-out runs asynchronously after the policy is committed.

3. Open the Instances view in the UI and select the myagent agent.

4. In the Agent Details card, click Open Chat.

5. Chat with the agent and ask it what it can do for you. Then, hit Enter and wait for the agent to reply. Verify that the agent lists the example_echo tool from the MCP server. The example_sum MCP tool is not shown, because you allowed access to only example_echo.

   

   

Other configurations

Review other common configuration examples.

Allow all tools on a server

Allow the myagent agent to invoke all tools on the mymcp MCP server, but restrict access to other MCP servers.

arctl apply -f- <<EOF
apiVersion: ar.dev/v1alpha1
kind: AccessPolicy
metadata:
  name: myagent-mymcp-all
spec:
  description: Allow myagent to invoke all tools on mymcp.
  principals:
    - kind: Deployment
      name: myagent
  rules:
    - actions:
        - runtime:invoke
      resources:
        - kind: server
          name: mymcp
EOF

Allow all tools on all servers

Allow the myagent agent to invoke all tools on all MCP servers.

arctl apply -f- <<EOF
apiVersion: ar.dev/v1alpha1
kind: AccessPolicy
metadata:
  name: myagent-all-servers
spec:
  description: Allow myagent to invoke all tools on all MCP servers.
  principals:
    - kind: Deployment
      name: myagent
  rules:
    - actions:
        - runtime:invoke
      resources:
        - kind: server
          name: "*"
EOF