Tool permissions

Tool permissions control which of a connector’s tools agents can use, in both Ask Sourcebot and MCP clients. Owners set them once for the whole workspace, and they apply to every member.

Each tool is either:

• Allowed: agents can use it.
• Blocked: agents can’t see or call it.

Every tool starts as Allowed when Sourcebot first sees it, including tools that create, change, or delete data. Review each connector’s tools after you add it, and block the ones you don’t want agents to use.

​

Edit tool permissions

1. Go to Settings → Workspace → Connectors.
2. Open the connector’s menu and select Edit tool permissions.
3. Use the toggle next to each tool to set it to Allowed or Blocked.

Changing a tool’s permission doesn’t require members to reconnect.

​

When changes take effect

Changes reach agents at different times, depending on where they run:

	Blocking a tool	Allowing a tool
Ask Sourcebot	From its next response	From its next response
MCP clients	Right away, including clients that are already connected	Within a few seconds, for clients that support tool list updates. Other clients after they reconnect.

Sourcebot checks permissions on every MCP client call, so a blocked tool stops working right away, even in a client that still lists it.

To keep a whole connector out of MCP clients while Ask Sourcebot can still use it, disable the connector in Settings → Workspace → MCP Gateway. See MCP Gateway.

​

Next steps

Connect a connector

Share with members how they connect their own accounts.

MCP Gateway

Turn connectors on or off for MCP clients.

Ask Sourcebot

Use connectors in your chats.

Audit logs

Review who changed a connector’s tool permissions.