MCP configuration

The flat configuration hub remains the compatibility route. This page is the canonical source-checked field reference for its family, including nested tables and list rows.

Paths in the tables are relative to [mcp]. Each row gives the serde type and source default or unset meaning. Check parsing and MCP policy cross-field rules with gdsgate doctor --config <PATH> --json, then follow the MCP server guide.

[mcp]

Used by: Authority.

Per-tool MCP policy inputs.

Key	Type	Default	Purpose
destructive_patterns	array of string	[]	Glob patterns marking a tool name as destructive. A matching tool's Tool Cedar entity gets is_destructive == true, so a policy can block it (forbid mcpCallTool when resource.is_destructive). Empty means every tool is non-destructive. This is operator-authoritative; a server's own destructiveHint is advisory.

[mcp]
destructive_patterns = ["*delete*", "drop_*", "exec_*", "*_admin"]

See Policy → MCP per-tool policy for the matching Cedar rules, and enforce_tool_policy on the MCP backend below to turn per-tool authorization on.