Operation tools
Beyond reading your docs, the server exposes one tool per endpoint that performs the real HTTP call. An agent can integrate against your API by calling it, not by imagining it.
Operation tools are not previews. A tool call hits your live API with the credentials you configure, and a write endpoint writes.
Point OCTRI_API_BASE_URL at a staging environment while you evaluate, and set destructive endpoints to Asks first or Off in MCP Studio.
They follow SDK Studio
Operation tools are derived from the same configuration as your SDKs, which means they're already curated:
| SDK Studio setting | Effect on operation tools |
|---|---|
| Endpoint excluded | No tool for it. The agent can't call it |
| Method renamed | The tool uses your name |
| Marked deprecated | Surfaced to the agent |
| Base URL | The default target for calls |
An endpoint that doesn't belong in a public SDK usually doesn't belong in an agent's hands either. Excluding it once covers both.
Setup
They need two things beyond the project id: where to call, and what to call with.
{
"mcpServers": {
"my-api": {
"command": "npx",
"args": ["@octri/mcp"],
"env": {
"OCTRI_PROJECT_ID": "YOUR_PROJECT_ID",
"OCTRI_API_BASE_URL": "https://api.staging.example.com",
"OCTRI_API_KEY": "sk_test_...",
"OCTRI_API_KEY_HEADER": "X-API-Key"
}
}
}
}Without a base URL, the tools fall back to the Base URL set in SDK Studio's Output tab. With neither, they return an error rather than guessing.
See Configuration for every credential form.
Agent access
Every operation tool has one of three settings, chosen per tool in MCP Studio:
| Setting | What happens |
|---|---|
| Runs on its own | The agent calls it whenever it decides to |
| Asks first | The server shows the user the exact request and sends it only if they approve |
| Off | The tool is not offered to agents. Your SDK and docs keep the endpoint |
Until you choose, reads (GET, HEAD, OPTIONS) run on their own and everything else asks first.
Changes are staged on the page and reach agents when you press Publish. They're published on their own, so turning a tool off never waits for, or cuts, a new SDK release.
How approval works
An Asks first call is built in full, then the server asks the user through MCP elicitation: the method, the URL, and the start of the body. The request goes out only on a yes. A declined call comes back to the agent as declined, with an instruction not to retry it.
Claude Code (2.1.76 and later) and VS Code can ask. A client that can't is refused the call rather than allowed to make it unapproved, and the refusal tells the user how to pre-approve the tool if they want to.
Claude Code prompts before every MCP tool call on its own. MCP Studio's Claude Code tab gives you a one-line .claude/settings.json rule that lets this server through, so a write is asked about once, by the prompt that shows the request.
Destructive hints
Every tool also tells the client whether it can destroy data. Writes are marked destructive by default. Tick Only adds data for an endpoint that only creates, such as a POST that adds a record, so clients can treat it more gently than a DELETE.
Limits on your own machine
Whoever runs the server can narrow what the owner allowed. Only one of these widens anything: pre-approving tools that would otherwise ask. Nothing brings back a tool the owner turned off.
| Variable | Flag | Effect |
|---|---|---|
OCTRI_READ_ONLY=1 | --read-only | Only tools that read are listed or run |
OCTRI_DENY_TOOLS=a,b | --deny-tools a,b | These tools are never listed or run |
OCTRI_ALLOW_TOOLS=a,b | --allow-tools a,b | These Asks first tools run without asking (* for all) |
OCTRI_ALLOW_WRITES=1 | --allow-writes | Same as OCTRI_ALLOW_TOOLS=* |
OCTRI_DRY_RUN=1 | --dry-run | Every call is built and returned to the agent, never sent |
Dry run is the safe way to watch an agent work against a production API: it sees exactly the requests it would make, and nothing happens.
Seeing which tools agents use
MCP Studio shows how many times agents called each tool in the last 30 days, beside the tool in the list and in full under its name: how many calls succeeded, failed, were declined or refused, when the last one was, and from which clients.
The server reports the tool name, how the call ended, how long it took, and the client's name. It never reports arguments or responses. To turn reporting off, set OCTRI_TELEMETRY=0 or pass --no-telemetry.
Scoping what an agent can do
Beyond agent access, three levers, in order of bluntness:
Agents are not adversarial, but they are literal. A tool named delete_all_users exists to be called, and "only in an emergency" is not something the tool description can enforce.
Treat the tool list as the set of things you're comfortable happening unattended.
From the CLI
octri mcp tools lists the tools agents are served, and octri mcp usage how often each is called.