---
title: "Set an MCP tool's policy"
method: PATCH
path: "/api/v1/org-mcp-servers/{server_id}/tools"
tags: ["authed"]
---

# Set an MCP tool's policy

`PATCH /api/v1/org-mcp-servers/{server_id}/tools`

## Request

- Base URL: `https://api.teaflask.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.teaflask.com/api/v1/org-mcp-servers/{server_id}/tools`
- Auth: none declared

Sets whether agents may call one of a server's tools (allow), need a
person's approval each time (ask), or may not call it (deny).

## Path parameters

- `server_id` string, uuid, required: The server's id, as list_org_mcp_servers returns it.

## Request body

- SetOrgMcpServerToolPolicyRequest
  - `tool_name` string, required: The tool's name on the server.
  - `policy` 'allow' | 'ask' | 'deny', required

## Response `200`

Successful Response

- OrgMcpServerToolResponse
  - `id` string, uuid, required: The tool's id, the paging cursor's second half.
  - `name` string, required: The tool's name on the server.
  - `agent_tool_name` string, required: The name agents call the tool by.
  - `label` string, required: The tool's title for people to read.
  - `description` string, required: What the server says the tool does.
  - `read_only` boolean, required: Whether the server says it only reads.
  - `destructive` boolean, required: Whether it may change or delete data, unless the server says it doesn't.
  - `policy` 'allow' | 'ask' | 'deny', required
  - `first_seen_at` string, date-time, required: When the server first listed it.
  - `missing` boolean, required: Whether the server stopped listing it; it keeps its policy.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: The server is gone, or it has no tool by that name
- `405`: Method not allowed
- `422`: Validation error
- `500`: Internal server error

## Changes

- **2026-11-03** `c6ac9fd6657f`: 6 info
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `401`
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `403`
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `404`
  - removed the `STEEP_LEARNING_DISABLED` enum value from the `error/code` response property for the response status `405`
  - …2 more

[Operation history](https://skmtc.dev/teaflask/apis/teaflask-api/changes/api/v1/org-mcp-servers/:server_id/tools/patch.md)

---

[API](https://skmtc.dev/teaflask/apis/teaflask-api.md) - [All operations](https://skmtc.dev/teaflask/apis/teaflask-api/llms.txt) - [OpenAPI document](https://skmtc.dev/teaflask/apis/teaflask-api/revisions/c6ac9fd6657f?raw)