Permissions and limits
Every operation tool has a setting for what happens when an agent calls it, and the server checks your limits before any request leaves it. All of this is set in MCP Studio and reaches agents when you publish, on the hosted server and in every local or self-hosted copy.
What happens when an agent calls a tool
When an agent calls itchoice| Value | What the agent gets |
|---|---|
| Runs on its own | The call goes straight to your API |
| Asks first | The client shows the person the exact request and waits for a yes |
| Off | The tool is never listed and cannot be called |
A read is GET, HEAD or OPTIONS.
Only adds data (never deletes or overwrites)on or offMarks a write as non-destructive for clients that read MCP's tool hints. Without it, every write is reported as destructive.
What the person running it can change
Someone running the server locally can hide more tools, or approve Asks first tools ahead of time, with --read-only, --deny-tools, --allow-tools, --allow-writes and --dry-run. Nothing they set brings back a tool you turned Off. Each flag is in configuration.
Tool groups
A group is a smaller server cut from the same tools. A tool you switched Off is in no group, and a tool that asks first still asks inside one. See tool groups.
Safety limits
In the Safety limits block. Each is off until you turn it on.
Cap writes per sessionnumberStops a session after that many calls that change data, from 1 to 10,000. The page suggests 50.
Cap calls per minute per toolnumberSlows any single tool, from 1 to 6,000. The page suggests 60.
Per-tool limitsper toolGives a specific tool its own calls per minute, up to 6,000, and says whether its calls count as writes.
A write is any call that isn't GET, HEAD or OPTIONS. If a tool is really a read, such as a POST search, mark it under Per-tool limits so it doesn't count.
Limits are checked before the approval prompt, so an agent over its cap is told so without asking the person anything. They apply on every plan.
The hosted server enforces limits across every session, group and installation. A self-hosted server enforces them in its own process, as a best effort.
Audit log
Keep an audit log of writes records every write an agent attempts, approved or not: the tool and request, its arguments with secrets redacted, who sent it and from which client, whether the person approved it, and the status that came back.
Filter it by outcome, tool, session or identity, and take a copy with Export CSV or Export JSON.
| Plan | Kept for |
|---|---|
| Free | 12 hours |
| Starter | 30 days |
| Growth | 90 days |
| Business and Enterprise | 1 year |
Practice mode
Turn on practice mode opens a separate address where every tool answers with sample data, and nothing reaches your API. See practice mode.
Outage warnings
If monitoring knows your API is down, a tool can say so, and the agent can stop retrying. See errors, outages and changes.
From the CLI
Permissions can be listed and set with octri mcp permissions, and the audit log read and exported with octri mcp audit.