Control which tools a model can use

Tool visibility controls let you give a model a smaller, more relevant tool set. Use a global deny list for capabilities you never want advertised, or a slot deny list to keep a local model focused without restricting a larger model.

Toggle tools in the REPLCopy Anchor Link

A row marked ← off in <file> is disabled by another configuration tier. Edit that file to enable it. The menu cannot override a project or legacy deny list. On Telegram and other noninteractive surfaces, /config shows the current settings without an interactive checklist.

Edit the deny lists directlyCopy Anchor Link

Put this in afk.config.json:

{
  "tools": {
    "disabled": ["image", "mcp__github__*"],
    "disabledBySlot": {
      "local": ["browser", "peer", "schedules", "bash"]
    }
  }
}

tools.disabled applies to every model. tools.disabledBySlot adds restrictions for the active model slot. It cannot turn a globally disabled tool back on.

These are operator settings. The agent's config_set, /config set, and afk config set cannot change either key. Use the Tools menu for the global list, or edit JSON for either list. There is no per-slot checklist yet.

Entry vocabularyCopy Anchor Link

General glob patterns are not supported. Unknown names and invalid entries produce warnings. A bad entry does not invalidate valid entries alongside it.

The locked core tools cannot be hidden this way: agent, skill, compose, exit_plan_mode, get_runtime_state, read_file, write_file, edit_file, grep, glob, and list_directory. Attempts to deny them are ignored with a warning. Existing read-only subagent restrictions still apply.

Configuration tiers and model changesCopy Anchor Link

The global lists from project, user, and legacy configuration files are unioned. Removing an entry from one file does not enable it if another file still denies it. Global settings are captured when a provider is constructed, so restart after editing them.

The slot list follows the model resolved for the current query. A slot can be selected by its slot key, its configured display name, or a raw model ID bound to that slot. A fixed alias such as sonnet or opus is not itself a slot selection. Slot lists are reread when the query dispatcher is built; a /model change follows the new slot. Each subagent resolves its own model's slot list, not its parent's.

Both providers remove disabled tools from advertised schemas and refuse attempted calls. A later MCP refresh or custom tool registration does not reenable a denied tool.

Hide a skill without removing its slash commandCopy Anchor Link

To keep a skill out of the model-facing manifest, add its name to the operator-controlled skills.hidden setting:

{
  "skills": {
    "hidden": ["my-release", "team:incident-report"]
  }
}

Bare names and plugin-qualified names are matched against skill names. You can still invoke the skill explicitly with its slash command.

For a skill you author, put the setting in SKILL.md frontmatter instead:

---
name: my-release
description: Prepare a release checklist.
disable-model-invocation: true
---

Prepare the release checklist for this repository.

This is a discovery control, not an execution denial. A hidden skill remains registered and slash-invocable; knowing its name is not an authorization boundary.

Visibility is not permissionCopy Anchor Link

Permission modes, tool allowlists, path grants, and hooks remain independent checks. Bypass permission mode does not reenable a denied tool, and enabling a tool in the menu does not override a read-only fork or a blocking hook. Use those controls, plus operating-system isolation where needed, to enforce security policy.

RelatedCopy Anchor Link