Octri

mcp permissions

Lists every endpoint tool with what an agent may do with it and whether it's marked destructive. Changes apply at once, with no MCP publish. Switching a dangerous tool off shouldn't have to wait. See permissions and limits.

bash
octri mcp permissions [list | set <tool> <policy>]

octri mcp permissions set <tool> <policy>

Sets one tool's policy. If a teammate published in the meantime, it tells you instead of overwriting their change.

Arguments

<tool>stringrequired

The tool's name, or its endpoint's slug.

<policy>stringrequired

What the agent may do.

ValueMeaning
autoCall it without asking
confirmCall it only after the person approves
offNot see it at all

Flags

--destructiveboolean

Marks the tool as one that changes or deletes data. --no-destructive clears it.

Examples

List policies

bash
octri mcp permissions
Output
✔ Loading tool permissions

MCP tool permissions (23, revision 6)
  TOOL                       ENDPOINT                                     POLICY   DESTRUCTIVE
  ─────────────────────────  ───────────────────────────────────────────  ───────  ───────────
  listCustomers              GET /customers                               auto     no
  createCustomer             POST /customers                              confirm  yes
  deleteCustomer             DELETE /customers/{customerId}               confirm  yes
  getCustomer                GET /customers/{customerId}                  auto     no
  updateCustomer             PATCH /customers/{customerId}                confirm  yes
  listCustomerSubscriptions  GET /customers/{customerId}/subscriptions    auto     no
  listEvents                 GET /events                                  auto     no
  …

Ask before deleting

bash
octri mcp permissions set deleteCustomer confirm --destructive
Output
✔ Publishing permissions for deleteCustomer
✔ deleteCustomer is confirm (revision 7)