MCP tool permission planner

Pick a server and a job for your agent. You get a tool-by-tool list of what to allow and what to hold, with the reason for each hold.

MCP tool permission planner

1 of 4

Which MCP server is the agent connecting to?

Both lists are the server’s own tool names, checked against its documentation.

How it works

An MCP server hands an agent every tool it has. The official GitHub server lists 92 of them in its README, from reading a file to deleting a repository, and the Notion server has 29 for pages, databases, comments and trash. This planner starts from the agent’s job and allows only the tools that job needs. A read-only researcher on GitHub gets 27 tools. A coding agent gets 37, of which 7 can change things, and merge_pull_request is held because opening a pull request and merging it are different decisions.

The third question changes the plan. If the agent reads text that strangers can write, such as public issues or pull requests from forks, a planted instruction can tell it to do something. When it can also read sensitive data and post text, the planner holds one side of that pair. A security alert triager keeps its alert reads and loses its comment tools. An issue triager keeps its comments and loses nothing sensitive, because it never had any. Anything that deletes or merges is held for every agent that reads strangers’ text. Answering Not sure gives the same plan as Yes.

Some tools cannot be split. GitHub’s label_write creates, updates and deletes labels, and projects_write includes delete_project_item. Allowing the tool allows all of it, so those tools carry a note and a warning when they are on. Notion’s notion-update-data-source removes any select option left out of the list you send. Whether a tool reads, changes things or deletes is this tool’s judgement from each server’s documentation, not a label the servers publish.

For GitHub the result includes a GITHUB_TOOLS line that the server accepts as its own allowlist, and the page says what to check after you set it. A server-side list only covers one server and one agent. To give each agent its own tool-level rules across every server, see MCP permissions, and to record every call that does get through, see MCP audit logs. If you want to score the rest of your setup, the MCP security checklist takes thirteen questions. Nothing you pick is sent anywhere.

Questions

From each server’s own documentation, read on 15 October 2026: the Tools section of the GitHub MCP server README and the supported tools page in Notion’s developer docs. Tools that appear in neither are not listed. Servers change, so check a name against the current README before you put it in a config.

Each hold shows its reason. Some are decided by the job, such as merge_pull_request for a coding agent. Others come from the strangers question. Switch any tool to Allowed and the page warns you if that creates a risky pair.

No. The planner writes a plan. For GitHub you can apply the allowlist with GITHUB_TOOLS, and Notion lets an admin choose the tools on a workspace connection. In Statio you grant an agent a server and deny individual tools on top, and a tool-level deny overrides the server grant.

Because the cost of being wrong is lopsided. If you pick Yes and nobody was writing in your issues, you held a few tools you can switch back on. If you pick No and a stranger had been, an agent could have followed an instruction in an issue.