add the ability to set a list of allowed tools on an mcp server

[JohnUiterwyk]

Description

There are cases where we may want to restrict an agent to only be allowed to use a subset of tools returned by a particular MCP server. For example for a filesystem MCP server, we may want to restrict the agent to tools that are read only. This can be support by adding a allowed_tools parameter to the MCPServer class.
Initially we this could be supported through by an explicit list of tool names; subsequent improvements could support regex/glob patterns.

References

No response

[Kludex]

I think this should be part of a tool_choice parameter.

[JohnUiterwyk]

My understanding of tool_choice is that it is meant to require that a model call a specific or set of tools, and is done model side.

This feature request is instead is about limiting the tools provided to the model (and in pydantic ai, a specific agent.)

There will also be cases were there are a large number of tools and tool sets, and we may want to restrict the tools that the model is provided schemas for (as model context size impacts response time and instruction following).

Another case is rbac , where we may decide one user can only use tools x,y,z and another can use all.

(The other consideration, is that as part of a in progress multiagent flow, a previous agent may want to specify a subset of tools for a downstream agent to have the option to apply for some task)

It also would lets us use an externally provided mcp implementation, and without modification of the server, use a subset of capabilities.

How were you thinking it would work with tool_choice?

[milani]

I run into this issue, but more generally and not for MCP. I define an agent for a set of related tasks that share the same system prompt and I pass it the tools required for all those tasks. But not all tasks need access to all tools.

Given that the LLM has access to the tools, it sometimes just calls them even when it doesn't make sense.

class MyOverarchingGoal:
  def __init__(self):
    self.agent = Agent(..., tools=[<set of tools>])

  def a_task(self, input):
    ...
    output = self.agent.run(...)
    ...

  def b_task(self, input):
    ...
    output = self.agent.run()
    ...

One solution is to accept a list of available tools as an argument of agent.run. This is how AI SDK handles it: https://sdk.vercel.ai/docs/ai-sdk-core/tools-and-tool-calling#active-tools

[Lewik]

Maybe this will help?
https://github.com/Lewik/mcp-tools-proxy