enabled_tools = ["read", "search"]
Follow a practical setup path, understand the permission boundary and leave with a configuration you can review and adapt.
Treat every server as a trust decision
An MCP server can expose tools that read private data or perform actions. Review who publishes the server, what process it launches, which services it reaches and what permissions its credentials provide.
Expose only the tools you need
Use a narrow enabled-tools list when a server exposes more capability than the workflow requires. Keep write tools behind an approval boundary.
[mcp_servers.example]
url = "https://mcp.example.com/mcp"
enabled_tools = ["read", "search"]
default_tools_approval_mode = "writes"Protect credentials
Pass tokens through environment variables or a supported authentication flow. Do not place live secrets in configuration files that may be committed, shared or copied into support messages.
- Use narrowly scoped credentials.
- Rotate credentials after suspected exposure.
- Separate development and production access.
- Review server and tool names for lookalikes.
Design clear approval boundaries
Read-only searches may be appropriate for automatic approval in a trusted environment. Writes, deployments, messages, purchases and destructive actions should remain clearly reviewable.
Download this guide’s configuration.
Review the endpoint, package, credentials and permission settings before using it in a trusted environment.
Frequently asked questions
Open source improves inspectability but does not replace publisher verification, dependency review, narrow permissions and safe credential handling.
Writes, messages, deployments, purchases, destructive actions and operations involving sensitive data should remain reviewable.
Provider endpoints, authentication requirements and supported options can change. Confirm current details before connecting a sensitive service.