Overview
Use this guide to control which Model Context Protocol (MCP) tools an agentic harness such as Claude Code can call, once its traffic routes through the F5 AI Gateway. The gateway inspects each tool call in the request and classifies it. It then applies your policy before the request reaches the model or the MCP server. A blocked tool call is stripped from the request entirely, so the backend service never receives it.
How tool classification works
Every MCP server and tool available to your organization is listed in the MCP Servers catalog, in GOVERN under Catalogs > MCP Servers. Each server entry shows a name, description, type, category, tags, and a link to the project.
Select a server's Tools tab to list its individual tools. Each tool carries a classification badge:
Read: the tool only reads or retrieves information.
Write: the tool can create, update, or delete a resource.
Use the catalog to look up a tool's exact name and classification before you add it to an allow list or block list.
When an agentic harness sends traffic through the F5 AI Gateway, the gateway inspects the request for MCP tool calls. It applies this same classification to decide how policy treats each one. A tool the gateway can't identify in the catalog is treated as Write, the more restrictive classification.
Before you begin
Before you begin, make sure you have:
Access to Default Policy or Group Policy configuration: in GOVERN, you need access to either Default Policy or Group Policies.
An agentic harness already routed through the gateway: tool policy only applies to traffic that already passes through the F5 AI Gateway. See Deploy the Claude Code Helper.
If you don't configure a tool policy, F5 Workforce AI Security applies a restrictive default. Only Read tools are allowed, and every other tool is blocked.
Configure tool policy
In GOVERN, go to Default Policy or Group Policies, and select the policy to configure.
Select the MCP Tools tab.
Turn on Allow Read-only to allow every tool classified as Read, without listing each one by name.
With Allow Read-only off, every tool, Read or Write, is subject to the Catch-all Action instead.
Search for a tool by name, then add it to the MCP Tool Allow List or the MCP Tool Block List.
An explicit entry on either list always takes precedence over Allow Read-only and the Catch-all Action. The block list strips a matching tool from the request even if Allow Read-only would otherwise permit it. The allow list permits a matching tool even if it's classified Write.
Set the Catch-all Action for any tool that isn't explicitly allowed or blocked, and isn't covered by Allow Read-only:
Ignore: the tool passes through with no policy enforcement.
Monitor: the tool passes through, and the call is recorded for audit.
Block: the tool is stripped from the request before it reaches the backend service.
Select Save.
Verify the configuration
Start a session in an agentic harness that routes through the gateway. Call an MCP tool that your policy blocks. Confirm the harness reports the tool as unavailable, then confirm the call appears in User Activity as a blocked tool call.
See tool calls and token usage
Every request that passes through the F5 AI Gateway is recorded as a User Activity event, whether or not it includes an MCP tool call.
For a request that includes one or more MCP tool calls, the event records:
The name of each tool, and the MCP server it belongs to
Its Read or Write classification
Whether policy allowed, monitored, or blocked it
Token usage for the request
Use User Activity to audit tool decisions across the organization. For example, find every request where a tool was blocked, or confirm a newly allow-listed tool now passes through. See Reading User Activity events.
Organizations that export telemetry to an external destination receive the same tool-call and token-usage data in the telemetry event stream. See Configuring telemetry destinations and Telemetry schema and format.
References
For more information, see:
Deploy the Claude Code Helper
Agentic development and agentic harnesses