openclaw - 💡(How to fix) Fix mcp.servers[name].toolDenylist: per-tool deny for MCP server installs

Use case

Operators want to install an MCP server but disable a subset of the tools it advertises. Two concrete cases we hit:

1. Filesystem MCP, scoped vault, read-only. Today's workaround: set a read-only ACL on the target directory. The filesystem MCP still advertises write_file / create_directory; the kernel returns EACCES at call time. Works on macOS for a filesystem-backed server, doesn't generalize.

2. Home Assistant MCP, read-state-only (no device control). HA's long-lived tokens don't carry granular scopes, and there's no OS-permission fallback (tools call HA over HTTP). To install this safely we'd need to suppress exec_service, set_attribute, etc. — no way to do that today.

Suggestion

Under openclaw.json::mcp.servers[<name>], add an optional field:

{
  "mcp": {
    "servers": {
      "homeassistant": {
        "command": "...",
        "args": ["..."],
        "toolDenylist": ["exec_service", "set_attribute"]
      }
    }
  }
}

The gateway:

1. Filters matching tool names out of tools/list responses, so the model never sees them.
2. Rejects matching tools/call requests with a clear error (so a model that ignores the list can't call them anyway).

Match by exact name; no glob/regex in v1.

Why gateway-side

The alternative is forking each server we want to restrict and shipping vendored wrappers. That's per-server maintenance burden for what's structurally a one-line config choice. Filtering at the gateway applies uniformly to any server in the catalog.

Alternative shape

A combined toolFilter field that accepts either an allowlist or a denylist:

"toolFilter": { "allowlist": ["read_file", "list_directory"] }

or

"toolFilter": { "denylist": ["exec_service"] }

If you'd prefer explicit allowlisting (safer default for unknown-tool drift across server upgrades), this shape is cleaner. Either works for us.

What we'd do with it

Wire our Home Assistant skill install to pass the denylist in "read mode". Generalize across our skill catalog: each skill declares its dangerous_tools, the install wrapper translates to toolDenylist (or allowlist) at config-write time.

Environment

• openclaw v2026.5.x
• macOS