Repository navigation
tools config deny rules silently overridden by "*": "ask" in permission config #15664
Description
Description
Can't disable tools from mcp server that I don't use. I listed "": "ask" in my permissions config - opus found out that this is the issue - I verified that without "": "ask" exclusion works.
Here is short summary:
- Root cause: config.ts:215 — mergeDeep(perms, result.permission) places tools-derived deny rules before the catch-all ask rule, and disabled() at next.ts:252
uses findLast which returns the catch-all instead of the more specific rule
- Fix suggestion: Either use specificity-based matching in disabled(), or reverse the merge order to mergeDeep(result.permission, perms) so deny rules come after
the catch-all
Plugins
No response
OpenCode version
1.2.15
Steps to reproduce
- Create a global config at ~/.config/opencode/opencode.json with both a tools section (deny rules using glob patterns) and a permission section containing a
"*": "ask" catch-all:
{
tools: {
some_tool_*: false
},
permission: {
*: ask,
read: allow
}
}
-
Have an MCP server registered that provides tools matching the glob pattern (e.g., some_tool_foo, some_tool_bar)
-
Restart OpenCode
-
Ask the agent to list its available tools — the denied tools still appear
Screenshot and/or share link
No response
Operating System
No response
Terminal
No response
Activity
github-actions commentedon Mar 2, 2026
This issue might be a duplicate of existing issues. Please check:
If your issue is distinct from the above, please add a comment clarifying how it differs.
Gamezar commentedon Mar 2, 2026
Not well-versed with opencode to understand similarity.
For me it seems like different issue, but maybe similar symptomps
github-actions commentedon Jul 3, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.