Every tool behind the configuration door /mcpconfig has a right of its own. That right is necessary but never enough.
The chain
tool_config_use— the master switch. Without this right the tool list is empty.tool_config_<tool>— one right per tool. Plan and apply each have their own right, so you can let someone look without letting them change anything.- The functional right behind the tool — the very same right the screen uses.
- When writing: both configuration locks must be open. Tools with level 2 are not run on a production environment.
Who holds these rights?
The rights sit in the MCP-Config group, together with the functional rights the tools need. A fresh install gets that group automatically; on an upgraded environment you set it up with the button on Configuration → AI settings → Tools. Either way the group starts without members: adding someone to the group is the step that turns configuring through AI on for that person.
What the tools do is described on MCP configuration tools.
tool_config_combi_update_plan
Show the intended change of a package through AI.
tool_config_config_diff_vs_baseline
Retrieve configuration differences from the base installation through AI.
tool_config_content_block_create_apply
Create a front block through AI.
tool_config_content_block_create_plan
Show the intended creation of a front block through AI.
tool_config_content_block_delete_apply
Delete a front block through AI.
tool_config_content_block_delete_plan
Show the intended deletion of a front block through AI.
tool_config_content_block_describe
Retrieve front blocks and their settings through AI.
tool_config_content_block_patch_apply
Change part of a front block field through AI.
tool_config_content_block_patch_plan
Show the intended partial change of a front block through AI.
tool_config_content_block_update_apply
Change a front block through AI.
