18 pages for toolpolicy.
Titles and paths first, then pages whose text carries it. Each row opens that page as this site last read it.
Configure permissions
Claude Code CLI · in the page
agent-sdk/permissions
…_deny`](https://code.claude.com/docs/en/agent-sdk/typescript#mcpservertoolpolicy), a call to that tool is denied at this step. **3. Ask rules** Check `ask` rules from [settings.json](https://code.cl…
Agent SDK reference - TypeScript
Claude Code CLI · in the page
agent-sdk/typescript
…eHint: true` explicitly on any tool you mark [`always_ask`](#mcpservertoolpolicy), or the auto mode classifier can approve that tool's calls in place of your `canUseTool` callback. Leaving `destructiv…
Claude apps gateway configuration
Claude Code CLI · in the page
claude-apps-gateway-config
…li` block from the base. If you set `disabledBuiltinTools` or `builtinToolPolicy` in both the base and a role policy, the gateway keeps the base's restriction: * `disabledBuiltinTools`: the gateway u…
Desktop application
Claude Code CLI · in the page
desktop
…"http"`, `"sse"`, or `"stdio"`, connection details, and optionally a `toolPolicy` map to restrict which of that server's tools users can invoke. Deliver it through the managed settings file, MDM, or a…
Changelog
Claude Documentation · in the page
cowork/changelog
…a listed Opus 4.5 or newer. * Fixed connector tools set to `ask` in `toolPolicy` not showing an approval prompt in Auto mode on devices with their own Claude Code managed settings. They now ask, so u…
Built-in connectors
Claude Documentation · in the page
third-party/claude-desktop/built-in-connectors
…e entry. * **Tool approvals.** Each entry accepts the same per-tool [`toolPolicy`](https://claude.com/docs/third-party/claude-desktop/configuration#managedmcpservers) as any managed server. Without a…
Chat in Claude Desktop on 3P
Claude Documentation · in the page
third-party/claude-desktop/chat
…le in Chat with the same approval model as Cowork sessions: a tool's `toolPolicy` of `"allow"` pre-approves it, `"blocked"` blocks it, and `"ask"` requires user approval on every call. When Claude cal…
Code in Claude Desktop on 3P
Claude Documentation · in the page
third-party/claude-desktop/code
…rock, are removed automatically in addition to your list. | | `builtinToolPolicy` | Tools set to `"ask"` require approval on each call in Code sessions, enforced via a PreToolUse hook and Claude Code…
Configuration reference
Claude Documentation · in the page
third-party/claude-desktop/configuration
…kip WebFetch domain check | Capabilities | Admin Console | | [`builtinToolPolicy`](#builtintoolpolicy) | Built-in tool policy | Capabilities | Admin Console | | [`disabledBuiltinTools`](#disabledbuilt…
Configuration changelog
Claude Documentation · in the page
third-party/claude-desktop/configuration-changelog
…b"`: `pull_request_review_write` now asks before every call whatever `toolPolicy` says, and is refused where Claude can show no prompt. `toolPolicy` can still block it. The connector is updated to git…
Connect to GitHub
Claude Documentation · in the page
third-party/claude-desktop/connectors-github
…m only | Supported; set `host` | | Tool surface controls | Per-tool [`toolPolicy`](https://claude.com/docs/third-party/claude-desktop/configuration#managedmcpservers) | `toolsets`, `readOnly`, and per…
Connect to Microsoft 365
Claude Documentation · in the page
third-party/claude-desktop/connectors-m365
…e tools](#block-remote-connector-write-tools-in-claude-desktop) with `toolPolicy` on the other devices | Claude Desktop managed configuration | #### Revoke write scopes on the remote connector Revok…
User identity and local data
Claude Documentation · in the page
third-party/claude-desktop/data-storage
…d#sandbox-network-access), in connector tool calls permitted by your `toolPolicy` configuration and the user's approvals, in telemetry to your own collector if you have enabled [content capture](https…
MCP, plugins, skills, and hooks
Claude Documentation · in the page
third-party/claude-desktop/extensions
…http", "url": "https://mcp.example.corp", "oauth": true, "toolPolicy": { "search": "allow", "delete_document": "blocked" } }, { "name": "ticketing", "transport": "http", "u…
Scheduled tasks in Claude Desktop on 3P
Claude Documentation · in the page
third-party/claude-desktop/scheduled-tasks
…nfiguration.md#tool-approvals-on-scheduled-tasks). A tool that your [`toolPolicy`](https://claude.com/docs/third-party/claude-desktop/configuration#tool-permissions-for-managed-mcp-servers) sets to `"…
SSH remote sessions in Claude Desktop on 3P
Claude Documentation · in the page
third-party/claude-desktop/ssh-remote-sessions
…and then fails. * **Tools that your policy sets to ask**: if [`builtinToolPolicy`](https://claude.com/docs/third-party/claude-desktop/configuration#builtintoolpolicy) sets a bare tool name, such as `B…
Unified Claude in Claude Desktop on 3P
Claude Documentation · in the page
third-party/claude-desktop/unified-claude
…rd-party/claude-desktop/configuration#disabledbuiltintools), [`builtinToolPolicy`](https://claude.com/docs/third-party/claude-desktop/configuration#builtintoolpolicy), [`allowedWorkspaceFolders`](http…
Web search and web fetch
Claude Documentation · in the page
third-party/claude-desktop/web-tools
…tavily", "headersHelper": "/opt/org/bin/tavily-headers", "toolPolicy": { "web_search": "allow" } } ] } ``` > [!NOTE] > > A hosted-vendor key configured in `headers` or returned by `…