Tool Policy

Replace the tool policy

Replace your organization’s tool policy (org admin only). Each rule names a tool type and an action: deny refuses requests that configure the tool, and require_approval holds each call until it is approved. MCP rules can be limited to servers by hostname and to tool names; a deny rule with tool_names removes those tools instead of refusing the request. The strictest matching rule applies, and nothing in a request or saved agent relaxes it. Changes reach every server within 10 seconds.

PUT

api

llm

tool_policy

Go (SDK)

package main

import(
	"context"
	mka1 "github.com/MeetKai/mka1-sdks/go"
	"github.com/MeetKai/mka1-sdks/go/models/components"
	"log"
)

func main() {
    ctx := context.Background()

    s := mka1.New(
        mka1.WithSecurity("<YOUR_BEARER_TOKEN_HERE>"),
    )

    res, err := s.ToolPolicy.UpdateToolPolicy(ctx, components.UpdateToolPolicyRequest{
        Rules: []components.ToolPolicyRule{
            components.ToolPolicyRule{
                Type: components.PolicyToolTypeCodeInterpreter,
                Action: components.ToolPolicyActionDeny,
            },
            components.ToolPolicyRule{
                Type: components.PolicyToolTypeMcp,
                Action: components.ToolPolicyActionRequireApproval,
            },
            components.ToolPolicyRule{
                Type: components.PolicyToolTypeMcp,
                Action: components.ToolPolicyActionDeny,
                ServerDomains: []string{
                    "mcp.example.com",
                },
                ToolNames: []string{
                    "delete_repository",
                },
            },
        },
    })
    if err != nil {
        log.Fatal(err)
    }
    if res.ToolPolicy != nil {
        // handle response
    }
}

using MeetKai.MKA1;
using MeetKai.MKA1.Types.Components;
using System.Collections.Generic;

var sdk = new SDK(bearerAuth: "<YOUR_BEARER_TOKEN_HERE>");

UpdateToolPolicyRequest req = new UpdateToolPolicyRequest() {
    Rules = new List<ToolPolicyRule>() {
        new ToolPolicyRule() {
            Type = PolicyToolType.CodeInterpreter,
            Action = ToolPolicyAction.Deny,
        },
        new ToolPolicyRule() {
            Type = PolicyToolType.Mcp,
            Action = ToolPolicyAction.RequireApproval,
        },
        new ToolPolicyRule() {
            Type = PolicyToolType.Mcp,
            Action = ToolPolicyAction.Deny,
            ServerDomains = new List<string>() {
                "mcp.example.com",
            },
            ToolNames = new List<string>() {
                "delete_repository",
            },
        },
    },
};

var res = await sdk.ToolPolicy.UpdateToolPolicyAsync(req);

// handle response

from meetkai_mka1 import SDK


with SDK(
    bearer_auth="<YOUR_BEARER_TOKEN_HERE>",
) as sdk:

    res = sdk.tool_policy.update_tool_policy(rules=[
        {
            "type": "code_interpreter",
            "action": "deny",
        },
        {
            "type": "mcp",
            "action": "require_approval",
        },
        {
            "type": "mcp",
            "action": "deny",
            "server_domains": [
                "mcp.example.com",
            ],
            "tool_names": [
                "delete_repository",
            ],
        },
    ])

    # Handle response
    print(res)

import { SDK } from "@meetkai/mka1";

const sdk = new SDK({
  bearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
});

async function run() {
  const result = await sdk.toolPolicy.updateToolPolicy({
    rules: [
      {
        type: "code_interpreter",
        action: "deny",
      },
      {
        type: "mcp",
        action: "require_approval",
      },
      {
        type: "mcp",
        action: "deny",
        serverDomains: [
          "mcp.example.com",
        ],
        toolNames: [
          "delete_repository",
        ],
      },
    ],
  });

  console.log(result);
}

run();

curl --request PUT \
  --url https://apigw.mka1.com/api/v1/llm/tool_policy \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "rules": [
    {
      "type": "code_interpreter",
      "action": "deny"
    },
    {
      "type": "mcp",
      "action": "require_approval"
    },
    {
      "type": "mcp",
      "action": "deny",
      "server_domains": [
        "mcp.example.com"
      ],
      "tool_names": [
        "delete_repository"
      ]
    }
  ]
}
'

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rules: [
      {type: 'code_interpreter', action: 'deny'},
      {type: 'mcp', action: 'require_approval'},
      {
        type: 'mcp',
        action: 'deny',
        server_domains: ['mcp.example.com'],
        tool_names: ['delete_repository']
      }
    ]
  })
};

fetch('https://apigw.mka1.com/api/v1/llm/tool_policy', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://apigw.mka1.com/api/v1/llm/tool_policy",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'rules' => [
        [
                'type' => 'code_interpreter',
                'action' => 'deny'
        ],
        [
                'type' => 'mcp',
                'action' => 'require_approval'
        ],
        [
                'type' => 'mcp',
                'action' => 'deny',
                'server_domains' => [
                                'mcp.example.com'
                ],
                'tool_names' => [
                                'delete_repository'
                ]
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.put("https://apigw.mka1.com/api/v1/llm/tool_policy")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"rules\": [\n    {\n      \"type\": \"code_interpreter\",\n      \"action\": \"deny\"\n    },\n    {\n      \"type\": \"mcp\",\n      \"action\": \"require_approval\"\n    },\n    {\n      \"type\": \"mcp\",\n      \"action\": \"deny\",\n      \"server_domains\": [\n        \"mcp.example.com\"\n      ],\n      \"tool_names\": [\n        \"delete_repository\"\n      ]\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://apigw.mka1.com/api/v1/llm/tool_policy")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"rules\": [\n    {\n      \"type\": \"code_interpreter\",\n      \"action\": \"deny\"\n    },\n    {\n      \"type\": \"mcp\",\n      \"action\": \"require_approval\"\n    },\n    {\n      \"type\": \"mcp\",\n      \"action\": \"deny\",\n      \"server_domains\": [\n        \"mcp.example.com\"\n      ],\n      \"tool_names\": [\n        \"delete_repository\"\n      ]\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "object": "tool_policy",
  "rules": [
    {
      "type": "code_interpreter",
      "action": "deny"
    },
    {
      "type": "mcp",
      "action": "require_approval"
    },
    {
      "type": "mcp",
      "action": "deny",
      "server_domains": [
        "mcp.example.com"
      ],
      "tool_names": [
        "delete_repository"
      ]
    }
  ],
  "updated_at": "2026-11-05T12:00:00.000Z"
}

Authorizations

Authorization

string

header

required

Send Authorization: Bearer , using an MKA1 API key for automation or an OAuth API access token for a signed-in application. Use a dynamic security callback to refresh OAuth access tokens. Browser session-only operations still require their declared cookie.

Body

application/json

rules

Tool policy rule · object[]

required

The complete rule list, at most 200 rules and 64 KB. It replaces the stored policy; an empty list removes every restriction. Server domains are stored normalized.

Maximum array length: 200

Show child attributes

Response

200 - application/json

An organization's tool policy. It applies to every Responses request in the organization, including saved agent runs, and overrides what the request or agent configures.

object

any

required

rules

Stored tool policy rule · object[]

required

The organization's rules. When several rules match a tool, the strictest action applies: deny, then require_approval.

Show child attributes

updated_at

string<date-time> | null

required

When the policy was last changed; null when the organization has no policy.

⌘I

Go (SDK)

package main

import(
	"context"
	mka1 "github.com/MeetKai/mka1-sdks/go"
	"github.com/MeetKai/mka1-sdks/go/models/components"
	"log"
)

func main() {
    ctx := context.Background()

    s := mka1.New(
        mka1.WithSecurity("<YOUR_BEARER_TOKEN_HERE>"),
    )

    res, err := s.ToolPolicy.UpdateToolPolicy(ctx, components.UpdateToolPolicyRequest{
        Rules: []components.ToolPolicyRule{
            components.ToolPolicyRule{
                Type: components.PolicyToolTypeCodeInterpreter,
                Action: components.ToolPolicyActionDeny,
            },
            components.ToolPolicyRule{
                Type: components.PolicyToolTypeMcp,
                Action: components.ToolPolicyActionRequireApproval,
            },
            components.ToolPolicyRule{
                Type: components.PolicyToolTypeMcp,
                Action: components.ToolPolicyActionDeny,
                ServerDomains: []string{
                    "mcp.example.com",
                },
                ToolNames: []string{
                    "delete_repository",
                },
            },
        },
    })
    if err != nil {
        log.Fatal(err)
    }
    if res.ToolPolicy != nil {
        // handle response
    }
}

using MeetKai.MKA1;
using MeetKai.MKA1.Types.Components;
using System.Collections.Generic;

var sdk = new SDK(bearerAuth: "<YOUR_BEARER_TOKEN_HERE>");

UpdateToolPolicyRequest req = new UpdateToolPolicyRequest() {
    Rules = new List<ToolPolicyRule>() {
        new ToolPolicyRule() {
            Type = PolicyToolType.CodeInterpreter,
            Action = ToolPolicyAction.Deny,
        },
        new ToolPolicyRule() {
            Type = PolicyToolType.Mcp,
            Action = ToolPolicyAction.RequireApproval,
        },
        new ToolPolicyRule() {
            Type = PolicyToolType.Mcp,
            Action = ToolPolicyAction.Deny,
            ServerDomains = new List<string>() {
                "mcp.example.com",
            },
            ToolNames = new List<string>() {
                "delete_repository",
            },
        },
    },
};

var res = await sdk.ToolPolicy.UpdateToolPolicyAsync(req);

// handle response

from meetkai_mka1 import SDK


with SDK(
    bearer_auth="<YOUR_BEARER_TOKEN_HERE>",
) as sdk:

    res = sdk.tool_policy.update_tool_policy(rules=[
        {
            "type": "code_interpreter",
            "action": "deny",
        },
        {
            "type": "mcp",
            "action": "require_approval",
        },
        {
            "type": "mcp",
            "action": "deny",
            "server_domains": [
                "mcp.example.com",
            ],
            "tool_names": [
                "delete_repository",
            ],
        },
    ])

    # Handle response
    print(res)

import { SDK } from "@meetkai/mka1";

const sdk = new SDK({
  bearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
});

async function run() {
  const result = await sdk.toolPolicy.updateToolPolicy({
    rules: [
      {
        type: "code_interpreter",
        action: "deny",
      },
      {
        type: "mcp",
        action: "require_approval",
      },
      {
        type: "mcp",
        action: "deny",
        serverDomains: [
          "mcp.example.com",
        ],
        toolNames: [
          "delete_repository",
        ],
      },
    ],
  });

  console.log(result);
}

run();

curl --request PUT \
  --url https://apigw.mka1.com/api/v1/llm/tool_policy \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "rules": [
    {
      "type": "code_interpreter",
      "action": "deny"
    },
    {
      "type": "mcp",
      "action": "require_approval"
    },
    {
      "type": "mcp",
      "action": "deny",
      "server_domains": [
        "mcp.example.com"
      ],
      "tool_names": [
        "delete_repository"
      ]
    }
  ]
}
'

const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    rules: [
      {type: 'code_interpreter', action: 'deny'},
      {type: 'mcp', action: 'require_approval'},
      {
        type: 'mcp',
        action: 'deny',
        server_domains: ['mcp.example.com'],
        tool_names: ['delete_repository']
      }
    ]
  })
};

fetch('https://apigw.mka1.com/api/v1/llm/tool_policy', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://apigw.mka1.com/api/v1/llm/tool_policy",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PUT",
  CURLOPT_POSTFIELDS => json_encode([
    'rules' => [
        [
                'type' => 'code_interpreter',
                'action' => 'deny'
        ],
        [
                'type' => 'mcp',
                'action' => 'require_approval'
        ],
        [
                'type' => 'mcp',
                'action' => 'deny',
                'server_domains' => [
                                'mcp.example.com'
                ],
                'tool_names' => [
                                'delete_repository'
                ]
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.put("https://apigw.mka1.com/api/v1/llm/tool_policy")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"rules\": [\n    {\n      \"type\": \"code_interpreter\",\n      \"action\": \"deny\"\n    },\n    {\n      \"type\": \"mcp\",\n      \"action\": \"require_approval\"\n    },\n    {\n      \"type\": \"mcp\",\n      \"action\": \"deny\",\n      \"server_domains\": [\n        \"mcp.example.com\"\n      ],\n      \"tool_names\": [\n        \"delete_repository\"\n      ]\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://apigw.mka1.com/api/v1/llm/tool_policy")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"rules\": [\n    {\n      \"type\": \"code_interpreter\",\n      \"action\": \"deny\"\n    },\n    {\n      \"type\": \"mcp\",\n      \"action\": \"require_approval\"\n    },\n    {\n      \"type\": \"mcp\",\n      \"action\": \"deny\",\n      \"server_domains\": [\n        \"mcp.example.com\"\n      ],\n      \"tool_names\": [\n        \"delete_repository\"\n      ]\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "object": "tool_policy",
  "rules": [
    {
      "type": "code_interpreter",
      "action": "deny"
    },
    {
      "type": "mcp",
      "action": "require_approval"
    },
    {
      "type": "mcp",
      "action": "deny",
      "server_domains": [
        "mcp.example.com"
      ],
      "tool_names": [
        "delete_repository"
      ]
    }
  ],
  "updated_at": "2026-11-05T12:00:00.000Z"
}

Overview

Responses and conversations

Models and routing

Images and audio

Files and retrieval

Agents

Tools and sandbox

Evals and feedback

Compute

Repositories

Dataset generations

Organizations and access

Usage and budgets

Application utilities

Analytics

Legacy APIs

Additional APIs

Replace the tool policy

Authorizations

Body

Response