{ "permissions": { "deny": ["Read", "Edit", "MultiEdit", "Write", "Glob", "Grep"] } } ``` This makes Claude Code's built-in file tools unavailable, so the agent is forced to use agent-tool. Recommended when you want strict enforcement without relying on prompt instructions.

Codex CLI — model_instructions.md (global)

1. Add to `~/.codex/config.toml` (top-level, **not** inside `[mcp_servers.*]`): ```toml model_instructions_file = "~/.codex/model_instructions.md" ``` 2. Create `~/.codex/model_instructions.md`: ``` ALWAYS use agent-tool MCP tools (mcp__agent-tool__*) instead of built-in file tools. ``` 3. Restart Codex. **Per-project** — add to your project's `AGENTS.md` instead.

Cursor / Windsurf / Cline — .cursorrules or AGENTS.md

Add to your project's `.cursorrules`, `.windsurfrules`, or `AGENTS.md`: ``` ALWAYS use agent-tool MCP tools (mcp__agent-tool__*) instead of built-in file tools. ```

## Installation ### Auto-install (recommended) ```bash # Register with all detected agents (full auto-approve — all tools) agent-tool install # Safe mode — only auto-approve local file tools (no SSH, HTTP, DB, shell) agent-tool install --safe-approve # No auto-approve — manual approval required for every tool call agent-tool install --no-auto-approve # Register with a specific agent agent-tool install claude agent-tool install claude --safe-approve # Uninstall (removes agent-tool entry only, preserves other settings) agent-tool uninstall # from all agents agent-tool uninstall claude # from specific agent ``` **Install permission levels:** | Level | Flag | Auto-approved tools | |-------|------|---------------------| | Full (default) | _(none)_ | All tools (`mcp__agent-tool__*` wildcard) | | Safe | `--safe-approve` | 29 local-only tools (read, edit, write, grep, glob, etc.) — no SSH, HTTP, DB, bash, process control | | None | `--no-auto-approve` | No tools — every call requires manual approval | Approval level is independent of schema profile: installation may approve the full namespace while the server still starts with the token-efficient `core` profile. `toolbox` is intentionally not auto-approved by `--safe-approve`, because its `operation=call` gateway can invoke network, shell, database, and process-control tools. Safe-mode users should review each toolbox approval and avoid granting it a permanent allow rule unless they intend to trust the full AgentTool namespace. ### Manual setup **Claude Code / Cursor / Cline** (`settings.json` or `mcp.json`): ```json { "mcpServers": { "agent-tool": { "command": "/path/to/agent-tool" } } } ```