From f96b54590db6fd76f1abb0de09edca21c6fda68c Mon Sep 17 00:00:00 2001 From: Aiden Cline <63023139+rekram1-node@users.noreply.github.com> Date: Thu, 12 Nov 2026 10:28:25 -0600 Subject: [PATCH] docs: describe tools exposed directly when execute is denied (#63566) --- services/site/src/docs/content/mcp-servers.mdx | 2 +- services/site/src/docs/content/permissions.mdx | 2 +- services/site/src/docs/content/tools.mdx | 6 ++++-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/services/site/src/docs/content/mcp-servers.mdx b/services/site/src/docs/content/mcp-servers.mdx index 241fcf3a3b6..21f1074003a 100644 --- a/services/site/src/docs/content/mcp-servers.mdx +++ b/services/site/src/docs/content/mcp-servers.mdx @@ -481,7 +481,7 @@ When a server returns instructions during initialization, OpenCode adds them to For servers that use Code Mode, OpenCode adds a line that says where the agent can find the server's tools. -A server's instructions are omitted when the agent's permissions deny every one of its tools, or when they deny `execute` for a server that uses Code Mode. +A server's instructions are omitted when the agent's permissions deny every one of its tools. When they deny `execute`, the server's tools are listed directly and its instructions are kept without the Code Mode line. ## Input requests diff --git a/services/site/src/docs/content/permissions.mdx b/services/site/src/docs/content/permissions.mdx index b5acd30b4bb..fb09c3da8ce 100644 --- a/services/site/src/docs/content/permissions.mdx +++ b/services/site/src/docs/content/permissions.mdx @@ -123,7 +123,7 @@ currently use these actions and resources: | `_` | `*` for an MCP tool; unsupported characters in both names become `_` | | `opencode_list_mcp_resources` | MCP server name | | `opencode_read_mcp_resource` | `:` | -| `execute` | `*`; a deny removes Code Mode and the tools reached only through it, while nested tools enforce their rules | +| `execute` | `*`; a deny removes Code Mode and lists its tools directly, while nested tools enforce their rules | For example, allow one skill and deny all other skills: diff --git a/services/site/src/docs/content/tools.mdx b/services/site/src/docs/content/tools.mdx index 25e3fbd8d70..6f7dac76f35 100644 --- a/services/site/src/docs/content/tools.mdx +++ b/services/site/src/docs/content/tools.mdx @@ -236,8 +236,10 @@ Read package.json and README.md in parallel, then return their relevant setup de The runtime has no direct filesystem access, imports, or timers. It provides `fetch` for HTTP requests; everything else goes through tools in its catalog. -Denying `execute` with resource `*` removes Code Mode and every tool reached only -through it, including MCP tools from servers that do not set `codemode: false`. +Denying `execute` with resource `*` removes Code Mode. The tools it would reach, +including MCP tools from servers that do not set `codemode: false`, are then +listed as direct tools, each with its full definition in every request. Deny +those tools too if the agent should not have them. Nested built-in and MCP tools still enforce their own permissions, and plugin tools enforce the permissions they assert.