anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-23 02:36:57 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

MCP tool blocking not working - agents can still see and access disabled tools #2489

New Issue
Closed
opened 2026-02-16 17:35:54 -05:00 by yindo · 8 comments
yindo commented 2026-02-16 17:35:54 -05:00
Owner
Copy Link
Copy Source

Originally created by @SuperSonnix71 on GitHub (Nov 2, 2025).

Originally assigned to: @rekram1-node on GitHub.

MCP tool blocking not working - agents can still see and access disabled tools

Hey! I'm trying to disable specific MCP tools for an agent, but the agent can still see and try to use those tools even though they're disabled in the config.

What I tried

Agent configuration with MCP tool blocking:

{
  "agent": {
    "my-agent": {
      "model": "ollama/my-model",
      "tools": {
        "write": true,
        "edit": true,
        "bash": true,
        "mcp__my-server__*": false  // ← Trying to block all tools from an MCP server
      }
    }
  }
}

Expected behavior

The agent should NOT be able to see or access any MCP tools that are set to false.

Actual behavior

  1. The model can still see all the MCP tools in its function list
  2. The model tries to call these disabled tools
  3. The model gets confused because it sees the tools but they're supposed to be disabled

Example output from model:

The only functions provided are the mcp__* ones. 
The instructions say they are disabled.
Given restrictions, we cannot perform the task.

The model is clearly seeing the MCP tools in its available functions list, even though they're configured as false.

Environment

  • OpenCode version: Latest
  • MCP servers: Multiple (both local and remote)
  • Models: Ollama models via remote endpoint

Related

Found issue #1320 which mentioned disabled tools still being accessible, but it was closed. The tool blocking mechanism doesn't seem to work for MCP tools.

Expected vs Actual

Expected: Tool restrictions should completely hide the tools from the model's function list

Actual: MCP tools are visible to the model even when disabled, causing confusion and failed tool calls

Is this a known limitation? Any workaround?

Thanks!

Originally created by @SuperSonnix71 on GitHub (Nov 2, 2025). Originally assigned to: @rekram1-node on GitHub. # MCP tool blocking not working - agents can still see and access disabled tools Hey! I'm trying to disable specific MCP tools for an agent, but the agent can still see and try to use those tools even though they're disabled in the config. ## What I tried **Agent configuration with MCP tool blocking:** ```jsonc { "agent": { "my-agent": { "model": "ollama/my-model", "tools": { "write": true, "edit": true, "bash": true, "mcp__my-server__*": false // ← Trying to block all tools from an MCP server } } } } ``` ## Expected behavior The agent should NOT be able to see or access any MCP tools that are set to `false`. ## Actual behavior 1. The model can still **see** all the MCP tools in its function list 2. The model **tries to call** these disabled tools 3. The model gets confused because it sees the tools but they're supposed to be disabled **Example output from model:** ``` The only functions provided are the mcp__* ones. The instructions say they are disabled. Given restrictions, we cannot perform the task. ``` The model is clearly seeing the MCP tools in its available functions list, even though they're configured as `false`. ## Environment - OpenCode version: Latest - MCP servers: Multiple (both local and remote) - Models: Ollama models via remote endpoint ## Related Found issue #1320 which mentioned disabled tools still being accessible, but it was closed. The tool blocking mechanism doesn't seem to work for MCP tools. ## Expected vs Actual **Expected:** Tool restrictions should completely hide the tools from the model's function list **Actual:** MCP tools are visible to the model even when disabled, causing confusion and failed tool calls Is this a known limitation? Any workaround? Thanks!
yindo closed this issue 2026-02-16 17:35:54 -05:00
yindo commented 2026-02-16 17:35:54 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Nov 2, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #1320: Similar tool blocking issue where disabled tools were still accessible (closed but may not be fully resolved)
  • #3612: Feature request about denying MCP tools by default, mentions similar MCP tool blocking pattern not working
  • #2277: Request for ability to restrict MCP tool usage, mentions permissions don't work for MCP tools like they do for builtin tools

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Nov 2, 2025): This issue might be a duplicate of existing issues. Please check: - #1320: Similar tool blocking issue where disabled tools were still accessible (closed but may not be fully resolved) - #3612: Feature request about denying MCP tools by default, mentions similar MCP tool blocking pattern not working - #2277: Request for ability to restrict MCP tool usage, mentions permissions don't work for MCP tools like they do for builtin tools Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:35:54 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 2, 2025):

@SuperSonnix71 can you run: opencode debug config and show me the output?

@rekram1-node commented on GitHub (Nov 2, 2025): @SuperSonnix71 can you run: `opencode debug config` and show me the output?
yindo commented 2026-02-16 17:35:54 -05:00
Author
Owner
Copy Link
Copy Source

@SuperSonnix71 commented on GitHub (Nov 3, 2025):

@rekram1-node Thanks for looking into this! Here's the relevant output from opencode debug config:

"agent": {
  "ollama": {
    "model": "ollama/qwen3:32b",
    "tools": {
      "write": true,
      "edit": true,
      "bash": true,
      "task": true,
      "mcp__serena__*": false
    }
  }
}

Despite setting "mcp__serena__*": false, the ollama agent still sees all the Serena MCP tools in its function list. The model tries to use them and gets confused because it sees them as available but they're supposed to be blocked.

I had to work around this by adding explicit instructions in the agent prompt telling it to ignore the Serena tools, but they're still showing up in the function list which wastes tokens.

According to the OpenCode MCP docs, the tools config should "prevent them from being available to the LLM" - meaning OpenCode itself should filter these tools out before exposing them to the model. This is an OpenCode-level filter, not something the model should handle.

The behavior is the same no matter which model is used - all models still see the disabled MCP tools in their function list.

@SuperSonnix71 commented on GitHub (Nov 3, 2025): @rekram1-node Thanks for looking into this! Here's the relevant output from `opencode debug config`: ```jsonc "agent": { "ollama": { "model": "ollama/qwen3:32b", "tools": { "write": true, "edit": true, "bash": true, "task": true, "mcp__serena__*": false } } } ``` Despite setting `"mcp__serena__*": false`, the ollama agent still sees all the Serena MCP tools in its function list. The model tries to use them and gets confused because it sees them as available but they're supposed to be blocked. I had to work around this by adding explicit instructions in the agent prompt telling it to ignore the Serena tools, but they're still showing up in the function list which wastes tokens. According to the [OpenCode MCP docs](https://opencode.ai/docs/mcp-servers), the `tools` config should "prevent them from being available to the LLM" - meaning OpenCode itself should filter these tools out before exposing them to the model. This is an OpenCode-level filter, not something the model should handle. The behavior is the same no matter which model is used - all models still see the disabled MCP tools in their function list.
yindo commented 2026-02-16 17:35:54 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 3, 2025):

@SuperSonnix71 I need to see your mcp server definitions, that's why it'd be super helpful to see the entire dump.

My assumption is that the mcp server is called serena and that mcp__ prefix is causing the issue because it isn't part of the mcp server name.

All mcp tools are:

<mcp server name> + "_" + <tool name>

They don't have any special prefix

@rekram1-node commented on GitHub (Nov 3, 2025): @SuperSonnix71 I need to see your mcp server definitions, that's why it'd be super helpful to see the entire dump. My assumption is that the mcp server is called `serena` and that `mcp__` prefix is causing the issue because it isn't part of the mcp server name. All mcp tools are: \<mcp server name\> + "_" + \<tool name\> They don't have any special prefix
yindo commented 2026-02-16 17:35:54 -05:00
Author
Owner
Copy Link
Copy Source

@SuperSonnix71 commented on GitHub (Nov 3, 2025):

@rekram1-node I tried changing it to "serena_*": false ... seems to be working. even though, the MCP shows as connected. it cannot see it...
But then again, you never know with Qwen3. it's so noisy and dumb in the quantized version. Its talking about Minecraft mcp ?
Don't ask me why..

@SuperSonnix71 commented on GitHub (Nov 3, 2025): @rekram1-node I tried changing it to `"serena_*": false` ... **seems to be working**. even though, the MCP shows as connected. it cannot see it... But then again, you never know with Qwen3. it's so noisy and dumb in the quantized version. Its talking about Minecraft mcp ? Don't ask me why..
yindo commented 2026-02-16 17:35:54 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 3, 2025):

@SuperSonnix71 so there are 2 different things:

the sidebar showing you connected means opencode has a connection to that mcp server

the tools wildcard is saying which tools will be presented to the agent

@rekram1-node commented on GitHub (Nov 3, 2025): @SuperSonnix71 so there are 2 different things: the sidebar showing you connected means opencode has a connection to that mcp server the `tools` wildcard is saying which tools will be presented to the agent
yindo commented 2026-02-16 17:35:54 -05:00
Author
Owner
Copy Link
Copy Source

@SuperSonnix71 commented on GitHub (Nov 3, 2025):

@rekram1-node Thanks for all your help! quick and detailed as an old developer likes it!

@SuperSonnix71 commented on GitHub (Nov 3, 2025): @rekram1-node Thanks for all your help! quick and detailed as an old developer likes it!
yindo commented 2026-02-16 17:35:55 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 3, 2025):

Of course!

@rekram1-node commented on GitHub (Nov 3, 2025): Of course!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#2489
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?