---
id: FR-4
title: Tool rules
group: On this device
summary: Deciding which tools run without asking, which always ask, and which the assistant never sees
keywords: [tool rules, read-only, confirm, hidden, direct, policy, ask first, permissions]
---

Tool rules decide, server by server, what the assistant may do without your tap. Open the streamline in the Library, find the server under **MCP servers**, and open its **Tools**.

## The default

*Read-only tools run at once; anything else waits for your tap.* A tool counts as read-only when its server marks it so. Many servers mark nothing, which means every call waits for your tap until you set rules.

## The rules

Each rule is a list of tool names: **Add** one name at a time. A `*` stands for any characters, so `*_list` covers every tool whose name ends in `_list`.

- **Read only**: tools that only look things up, such as `account_get` or `*_list`. They run as soon as the assistant calls them.
- **Confirm**: tools that change something, such as `payment_add`. Each call stops at a confirmation card.
- **Confirm when args**: tools that read when called plain and write when called with details, such as `settings_set`. A plain call runs; a call with details asks.
- **Hidden**: tools the assistant should never use, such as `admin_reset`. It is not told they exist, and a call to one is refused.
- **Direct**: tools a button on a card can call with no assistant reply, such as `price_quote`. Any confirmation rule still applies.

When a tool is named in more than one list, the strictest wins: hidden, then confirm, then confirm when args, then read only. Your rules override what the server says about its own tools.

## What to watch for

- A tool under **Read only** runs with no card at all. Put only tools that read there. Moving a tool there, or out of **Hidden**, shows the change and waits for **Save** on that card.
- A new tool the server adds later follows the default until you name it, unless **Allow** leaves it out. The Library says when a server's tools change. See Choosing which tools a streamline uses (FR-9).
- Your rules govern the app. The server's own permissions still apply to everything it does for you.

See Confirmation cards (AS-2) for what asking looks like.