Support MCP server names and regexes in disabledTools

Also add disabledTools to agent markdown frontmatter (#534)

Author: ericdallo

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## Unreleased
 
 - Add agent `spawnableBy` configuration to restrict subagent discovery and spawning to specific primary agents.
+- Support MCP server names and regexes in `disabledTools` entries and add `disabledTools` to agent markdown frontmatter. #534
 
 ## 0.147.1
 

docs/config.json

@@ -113,8 +113,8 @@
     },
     "disabledTools": {
       "type": "array",
-      "description": "List of tool names to disable globally.",
-      "markdownDescription": "List of tool names to disable globally.",
+      "description": "Tools to disable globally. Each entry matches a builtin tool name or regex (no eca__ prefix needed), an exact MCP server name (disables all its tools), or a regex against the tool full name server__tool.",
+      "markdownDescription": "Tools to disable globally. Each entry matches a builtin tool name or regex (no `eca__` prefix needed), an exact MCP server name (disables all its tools), or a regex against the tool full name `server__tool`.",
       "items": {
         "type": "string"
       }
@@ -895,8 +895,8 @@
         },
         "disabledTools": {
           "type": "array",
-          "description": "Tools to disable for this agent.",
-          "markdownDescription": "Tools to disable for this agent.",
+          "description": "Tools to disable for this agent. Each entry matches a builtin tool name or regex (no eca__ prefix needed), an exact MCP server name (disables all its tools), or a regex against the tool full name server__tool.",
+          "markdownDescription": "Tools to disable for this agent. Each entry matches a builtin tool name or regex (no `eca__` prefix needed), an exact MCP server name (disables all its tools), or a regex against the tool full name `server__tool`.",
           "items": {
             "type": "string"
           }

docs/config/agents.md

@@ -111,6 +111,7 @@ Subagents can be configured in config or markdown and support/require these fiel
 - `spawnableBy` (optional): one primary agent ID or a collection of primary agent IDs allowed to discover and spawn this subagent. When omitted or empty, the subagent remains available to every primary agent.
 - `model` (optional): which full model to use for this subagent, using primary agent model if not specified.
 - `tools` (optional): same as ECA tool approval logic to control what tools are allowed/askable/denied.
+- `disabledTools` (optional): tools to hide from this agent entirely. Same matching as the global [`disabledTools`](tools.md#disabled-tools): a builtin tool name or regex (no `eca__` prefix needed), an exact MCP server name (all its tools), or a regex against the tool full name `server__tool`.
 - `maxSteps` (optional): set a max limit of turns/steps that his subagent must finish and return an answer.
 
 ### Parent-scoped subagents

docs/config/tools.md

@@ -237,9 +237,13 @@ Placeholders in the format `{{argument_name}}` within the `command` string will
 
 ## Disabled tools
 
-You can completely disable tools so they are never available to the LLM. This is configured via the `disabledTools` config, which accepts a list of tool name strings.
+You can completely disable tools so they are never available to the LLM. This is configured via the `disabledTools` config, which accepts a list of strings matched against each tool, in this order:
 
-It can be set globally or per agent.
+1. A builtin ECA tool name or regex, no `eca__` prefix needed: `edit_file`, `.*_file`.
+2. An exact MCP server name, disabling all tools of that server: `clojure-mcp`.
+3. A regex matched against the tool full name `server__tool`: `clojure-mcp__eval.*`, `my-mcp__dangerous_tool`.
+
+Regexes must match the whole name (anchored). It can be set globally, per agent or in the [agent markdown frontmatter](agents.md).
 
 === "Global"
 
@@ -261,9 +265,24 @@ It can be set globally or per agent.
     }
     ```
 
+=== "Whole MCP server per agent"
+
+    ```javascript title="~/.config/eca/config.json"
+    {
+      "mcpServers": {
+        "clojure-mcp": {"command": "..."}
+      },
+      "agent": {
+        "plan": {
+          "disabledTools": ["clojure-mcp"]
+        }
+      }
+    }
+    ```
+
 !!! tip "Disabled vs Denied"
 
-    `disabledTools` removes the tool entirely from the LLM — it won't even know it exists. This is different from `toolCall.approval.deny` which lets the LLM see the tool but blocks execution.
+    `disabledTools` removes the tool entirely from the LLM — it won't even know it exists. `toolCall.approval.deny` rules without `argsMatchers` also remove the tool from the LLM tool list, while rules with `argsMatchers` keep the tool visible and only block matching calls.
 
 ## Approval / permissions
 

src/eca/features/agents.clj

@@ -86,14 +86,34 @@
             (logger/warn logger-tag (format "Ignoring malformed spawnableBy value: %s" (pr-str spawnable-by)))
             nil)))
 
+(defn ^:private normalize-disabled-tools
+  "Coerces the YAML `disabledTools:` value into a vector of strings.
+   Accepts a single string or a list of strings; other shapes are ignored."
+  [disabled-tools]
+  (cond
+    (nil? disabled-tools) nil
+    (string? disabled-tools) (when-not (string/blank? disabled-tools)
+                               [disabled-tools])
+    (sequential? disabled-tools) (some->> disabled-tools
+                                          (keep (fn [entry]
+                                                  (let [s (str entry)]
+                                                    (when-not (string/blank? s) s))))
+                                          vec
+                                          not-empty)
+    :else (do
+            (logger/warn logger-tag (format "Ignoring malformed disabledTools value: %s" (pr-str disabled-tools)))
+            nil)))
+
 (defn ^:private md->agent-config
-  [{:keys [description mode model steps tools body inherit spawnableBy]}]
+  [{:keys [description mode model steps tools body inherit spawnableBy disabledTools]}]
   (let [tools-map (normalize-tools tools)
-        spawnable-by (normalize-spawnable-by spawnableBy)]
+        spawnable-by (normalize-spawnable-by spawnableBy)
+        disabled-tools (normalize-disabled-tools disabledTools)]
     (cond-> {}
       inherit (assoc :inherit (str inherit))
       description (assoc :description description)
       spawnable-by (assoc :spawnableBy spawnable-by)
+      disabled-tools (assoc :disabledTools disabled-tools)
       mode (assoc :mode (if (sequential? mode)
                           (mapv str mode)
                           (str mode)))

src/eca/features/tools.clj

@@ -24,7 +24,8 @@
    [eca.metrics :as metrics]
    [eca.shared :refer [assoc-some] :as shared])
   (:import
-   [java.util Map]))
+   [java.util Map]
+   [java.util.regex PatternSyntaxException]))
 
 (set! *warn-on-reflection* true)
 
@@ -117,9 +118,30 @@
                  (get-in config [:agent agent-name :disabledTools] [])
                  []))))
 
+(defn ^:private disabled-entry-matches?
+  "Matches a `disabledTools` entry against a tool, checking in order:
+   1. Entry as anchored regex against a eca builtin tool name (no `eca__` prefix needed).
+   2. Entry as exact server name, disabling all tools of that server.
+   3. Entry as anchored regex against the tool full name `server__tool`.
+   Invalid regexes fall back to literal equality."
+  [entry tool]
+  (let [server-name (:name (:server tool))
+        tool-name (:name tool)
+        full-name (str server-name "__" tool-name)
+        pattern (try (re-pattern entry)
+                     (catch PatternSyntaxException _ nil))]
+    (boolean
+     (or (and (= "eca" server-name)
+              (if pattern
+                (re-matches pattern tool-name)
+                (= entry tool-name)))
+         (= entry server-name)
+         (if pattern
+           (re-matches pattern full-name)
+           (= entry full-name))))))
+
 (defn ^:private tool-disabled? [tool disabled-tools]
-  (or (contains? disabled-tools (str (:name (:server tool)) "__" (:name tool)))
-      (contains? disabled-tools (:name tool))))
+  (boolean (some #(disabled-entry-matches? % tool) disabled-tools)))
 
 (defn make-tool-status-fn
   "Returns a function that marks tools as disabled based on config and agent.

test/eca/features/agents_test.clj

@@ -175,6 +175,33 @@
            (:spawnableBy (#'agents/md->agent-config {:description "partially valid"
                                                      :spawnableBy ["duel" 42 nil]})))))
 
+  (testing "disabledTools list is normalized to a vector of strings"
+    (let [md (str "---\n"
+                  "description: K8s agent\n"
+                  "disabledTools:\n"
+                  "  - clojure-mcp\n"
+                  "  - eca__shell_command\n"
+                  "  - \".*_file\"\n"
+                  "---\n\n"
+                  "Body.")
+          parsed (shared/parse-md md)
+          config (#'agents/md->agent-config parsed)]
+      (is (= ["clojure-mcp" "eca__shell_command" ".*_file"]
+             (:disabledTools config)))))
+
+  (testing "disabledTools single string becomes a vector"
+    (is (= ["clojure-mcp"]
+           (:disabledTools (#'agents/md->agent-config {:description "a"
+                                                       :disabledTools "clojure-mcp"})))))
+
+  (testing "omitted, empty or malformed disabledTools is ignored"
+    (is (nil? (:disabledTools (#'agents/md->agent-config {:description "a"}))))
+    (is (nil? (:disabledTools (#'agents/md->agent-config {:description "a" :disabledTools []}))))
+    (is (nil? (:disabledTools (#'agents/md->agent-config {:description "a" :disabledTools 42}))))
+    (is (= ["ok"]
+           (:disabledTools (#'agents/md->agent-config {:description "a"
+                                                       :disabledTools ["ok" "" nil]})))))
+
   (testing "tools as a YAML list normalizes to byDefault=ask + allow map (Claude form)"
     (let [md (str "---\n"
                   "description: Reviewer\n"

test/eca/features/tools_test.clj

@@ -152,6 +152,48 @@
       (is (= #{"plan_tool"}
              (#'f.tools/get-disabled-tools config "plan"))))))
 
+(deftest disabled-tools-matching-test
+  (let [db {:mcp-clients {"clojureMCP"
+                          {:version "1.0.2"
+                           :tools [{:name "eval" :description "eval code" :parameters {}}
+                                   {:name "sync_deps" :description "sync deps" :parameters {}}]}}}
+        full-names (fn [config] (set (map :full-name (f.tools/all-tools "123" "code" db config))))]
+    (testing "exact builtin tool short name (existing behavior)"
+      (let [names (full-names {:disabledTools ["edit_file"]})]
+        (is (not (contains? names "eca__edit_file")))
+        (is (contains? names "eca__read_file"))))
+    (testing "exact full name (existing behavior)"
+      (let [names (full-names {:disabledTools ["clojureMCP__eval"]})]
+        (is (not (contains? names "clojureMCP__eval")))
+        (is (contains? names "clojureMCP__sync_deps"))))
+    (testing "regex against builtin tool short names"
+      (let [names (full-names {:disabledTools [".*_file"]})]
+        (is (not (contains? names "eca__edit_file")))
+        (is (not (contains? names "eca__write_file")))
+        (is (not (contains? names "eca__move_file")))
+        (is (not (contains? names "eca__read_file")))))
+    (testing "server name disables all tools of that server"
+      (let [names (full-names {:disabledTools ["clojureMCP"]})]
+        (is (not (contains? names "clojureMCP__eval")))
+        (is (not (contains? names "clojureMCP__sync_deps")))
+        (is (contains? names "eca__read_file"))))
+    (testing "regex against full names"
+      (let [names (full-names {:disabledTools ["clojureMCP.*"]})]
+        (is (not (contains? names "clojureMCP__eval")))
+        (is (not (contains? names "clojureMCP__sync_deps")))
+        (is (contains? names "eca__read_file"))))
+    (testing "bare MCP tool name does not match"
+      (let [names (full-names {:disabledTools ["eval"]})]
+        (is (contains? names "clojureMCP__eval"))))
+    (testing "invalid regex is treated literally and does not throw"
+      (let [names (full-names {:disabledTools ["eval(" "clojureMCP__eval"]})]
+        (is (not (contains? names "clojureMCP__eval")))
+        (is (contains? names "clojureMCP__sync_deps"))))
+    (testing "server name works per agent"
+      (let [names (full-names {:agent {"code" {:disabledTools ["clojureMCP"]}}})]
+        (is (not (contains? names "clojureMCP__eval")))
+        (is (contains? names "eca__read_file"))))))
+
 (deftest approval-test
   (let [read-tool {:name "read" :server {:name "eca"} :origin :native}
         write-tool {:name "write" :server {:name "eca"} :origin :native}