fix: consolidate tool permission logic for consistent display and exe… #2975

nirajchowdhary · 2025-09-23T22:16:32Z

Issue #, if available: None

Overview

This change consolidates tool permission checking logic to ensure consistent behavior between the /tools display and actual tool execution in Q CLI.

Background

The CLI had two separate implementations for checking tool permissions:

Display path: Used for showing trust status in /tools command

Execution path: Used when actually running tools

These implementations had different wildcard pattern support, leading to inconsistent user experience.

Documentation Reference

https://github.com/aws/amazon-q-developer-cli/blob/main/docs/agent-format.md#allowedtools-field

According to the allowedTools specification:

Pattern Types:

Native tools: "fs_read", "fs_*"
MCP tools: "@server", "@server/tool", "@quip"

Key Rules:

Patterns starting with @ apply to MCP tools
Patterns without @ apply to native tools

Both support wildcard patterns (*, ?)

Solution

Created a centralized tool_permission_checker utility that:

Provides single source of truth for permission logic
Properly separates native vs MCP pattern matching
Ensures consistent wildcard support across all code paths
Stays consistent with Q cli documentation on allowedTools instructions

Testing

Ran cargo tests and all test succeeded
Check comment for detailed testing

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

…cution

nirajchowdhary · 2025-09-23T22:19:01Z

Before change Behavior:

Example Scenario

Configuration: in Agent mcp config file

{
 {
    "name": "amazon_q_default",
    "description": "Default agent configuration",
    "mcpServers": {

        "quip-mcp-server": {
            "command": "/home/Workspace/src/quip-mcp-server/dist/index.js",
            "transportType": "stdio",
            "timeout": 300000
        }
    },
    "tools": [
        "*"
    ],
    "allowedTools": [
        "fsRead",
        "*quip*"
    ],

    ...
    ...
    ..rest of config
} 
}

On running /tools displays MCP tools from `quip-server` showed as "not trusted"

🤖 You are chatting with claude-sonnet-4

[amazon_q_default] > /tools
Built-in:
- execute_bash                        * trust read-only commands
- fs_read                             * trust working directory
- fs_write                            * not trusted
- introspect                          * trusted
- knowledge                           * not trusted
- report_issue                        * trusted
- use_aws                             * trust read-only commands
- 
quip-mcp-server (MCP):
- get_quip_documents                  * not trusted
- search_quip_documents               * not trusted

On running q to read a quip document

Execution: it runs get_quip_documents tool as trusted without asking user for permission as seen shown above it being not trusted

[amazon_q_default] > read quip doc using quip mcp <<url to quip>>

> I'll read the Quip document for you. I notice there's a typo in the URL (.coam instead of .com), so I'll use the correct domain.


🛠️  Using tool: get_quip_documents (trusted) from mcp server quip-mcp-server
 ⋮ 
 ● Running get_quip_documents with the param:
 ⋮  {
 ⋮    "urls": [
 ⋮      "<url to quip>"
 ⋮    ]
 ⋮  }
^C

nirajchowdhary · 2025-09-23T22:23:46Z

After fix Behavior:

Example Scenario

Configuration: in Agent mcp config file

{
 {
    "name": "amazon_q_default",
    "description": "Default agent configuration",
    "mcpServers": {

        "quip-mcp-server": {
            "command": "/home/Workspace/src/quip-mcp-server/dist/index.js",
            "transportType": "stdio",
            "timeout": 300000
        }
    },
    "tools": [
        "*"
    ],
    "allowedTools": [
        "fsRead",
        "*quip*"
    ],

    ...
    ...
    ..rest of config
} 
}

On running /tools displays MCP tools from `quip-server` showed as "not trusted"

🤖 You are chatting with claude-sonnet-4

[amazon_q_default] > /tools
Built-in:
- execute_bash                        * trust read-only commands
- fs_read                             * trust working directory
- fs_write                            * not trusted
- introspect                          * trusted
- knowledge                           * not trusted
- report_issue                        * trusted
- use_aws                             * trust read-only commands
- 
quip-mcp-server (MCP):
- get_quip_documents                  * not trusted
- search_quip_documents               * not trusted

On running q to read a quip document

Execution: it runs get_quip_documents tool and asks for permission as it is not trusted

[amazon_q_default] > read a quip doc using quip mcp <url to quip>

> I'll read the Quip document for you using the MCP tool.


🛠️  Using tool: get_quip_documents from mcp server quip-mcp-server
 ⋮ 
 ● Running get_quip_documents with the param:
 ⋮  {
 ⋮    "urls": [
 ⋮      "<url to quip>"
 ⋮    ]
 ⋮  }

Allow this action? Use 't' to trust (always allow) this tool for the session. [y/n/t]:

[amazon_q_default] >

nirajchowdhary · 2025-09-23T22:27:47Z

Another After fix Behavior:

Example Scenario

Configuration: in Agent mcp config file

{
 {
    "name": "amazon_q_default",
    "description": "Default agent configuration",
    "mcpServers": {

        "quip-mcp-server": {
            "command": "/home/Workspace/src/quip-mcp-server/dist/index.js",
            "transportType": "stdio",
            "timeout": 300000
        }
    },
    "tools": [
        "*"
    ],
    "allowedTools": [
        "fsRead",
        "@*quip*"
    ],

    ...
    ...
    ..rest of config
} 
}

On running /tools displays MCP tools from `quip-server` showed as "not trusted"

🤖 You are chatting with claude-sonnet-4

[amazon_q_default] > /tools
Built-in:
- execute_bash                        * trust read-only commands
- fs_read                             * trust working directory
- fs_write                            * not trusted
- introspect                          * trusted
- knowledge                           * not trusted
- report_issue                        * trusted
- use_aws                             * trust read-only commands
- 
quip-mcp-server (MCP):
- get_quip_documents                  * trusted
- search_quip_documents               * trusted

On running q to read a quip document

Execution: this time since tool is trusted it reads directly without asking for permission

[amazon_q_default] > read a quip doc using quip mcp <url to quip>

> I'll read the Quip document for you using the MCP tool.


🛠️  Using tool: get_quip_documents (trusted) from mcp server santos-quip-mcp-server
 ⋮ 
 ● Running get_quip_documents with the param:
 ⋮  {
 ⋮    "urls": [
 ⋮      "<url to quip>"
 ⋮    ]
 ⋮  }
^C

kkashilk

Can you confirm that you've run -

cargo clippy --locked --workspace --color always -- -D warnings

cargo +nightly fmt --check -- --color always

cargo +nightly fmt

kkashilk · 2025-09-23T23:42:37Z

crates/chat-cli/src/util/tool_permission_checker.rs

+        // Native tool
+        None => {
+            let patterns = filter_patterns(|p| !p.starts_with('@'));
+            info!("Native patterns: {:?}", patterns);


nit: change info! to debug! unless necessary.

You can run Q_LOG_LEVEL=debug cargo run... to get these logs if necessary.

kkashilk · 2025-09-23T23:46:11Z

crates/chat-cli/src/util/tool_permission_checker.rs

+
+/// Checks if a tool is allowed based on the agent's allowed_tools configuration.
+/// This function handles both native tools and MCP tools with wildcard pattern support.
+pub fn is_tool_allowed(


We can replace the call to matches_any_pattern in native tool validation as well

For example -

amazon-q-developer-cli/crates/chat-cli/src/cli/chat/tools/fs_read.rs

Line 116 in 13fedbd

let is_in_allowlist = matches_any_pattern(&agent.allowed_tools, "fs_read");

Good callout

kkashilk · 2025-09-23T23:51:45Z

crates/chat-cli/src/cli/agent/mod.rs

+                ToolOrigin::Native => None,
+                _ => Some(<ToolOrigin as Borrow<str>>::borrow(origin)),
+            };
+            is_tool_allowed(&a.allowed_tools, tool_name, server_name)


nit: change method name to is_tool_in_allowlist.

Whether a tool is allowed or not is a bit more complicated depending on the tool

aws#2975) * fix: consolidate tool permission logic for consistent display and execution * fix: centralize tool permission checking logic --------- Co-authored-by: Niraj Chowdhary <[email protected]>

fix: consolidate tool permission logic for consistent display and exe…

ce625d1

…cution

kkashilk reviewed Sep 24, 2025

View reviewed changes

fix: centralize tool permission checking logic

74f0db1

kkashilk approved these changes Sep 24, 2025

View reviewed changes

kensave approved these changes Sep 24, 2025

View reviewed changes

kkashilk merged commit 5acd7e3 into aws:main Sep 25, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: consolidate tool permission logic for consistent display and exe… #2975

fix: consolidate tool permission logic for consistent display and exe… #2975

Uh oh!

nirajchowdhary commented Sep 23, 2025

Uh oh!

nirajchowdhary commented Sep 23, 2025 •

edited

Loading

Uh oh!

nirajchowdhary commented Sep 23, 2025

Uh oh!

nirajchowdhary commented Sep 23, 2025

Uh oh!

kkashilk left a comment

Uh oh!

kkashilk Sep 23, 2025

Uh oh!

kkashilk Sep 23, 2025

Uh oh!

nirajchowdhary Sep 24, 2025

Uh oh!

kkashilk Sep 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

fix: consolidate tool permission logic for consistent display and exe… #2975

fix: consolidate tool permission logic for consistent display and exe… #2975

Uh oh!

Conversation

nirajchowdhary commented Sep 23, 2025

Overview

Background

Documentation Reference

According to the allowedTools specification:

Pattern Types:

Key Rules:

Solution

Testing

Uh oh!

nirajchowdhary commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Before change Behavior:

Example Scenario

On running /tools displays MCP tools from quip-server showed as "not trusted"

On running q to read a quip document

Uh oh!

nirajchowdhary commented Sep 23, 2025

After fix Behavior:

Example Scenario

On running /tools displays MCP tools from quip-server showed as "not trusted"

On running q to read a quip document

Uh oh!

nirajchowdhary commented Sep 23, 2025

Another After fix Behavior:

Example Scenario

On running /tools displays MCP tools from quip-server showed as "not trusted"

On running q to read a quip document

Uh oh!

kkashilk left a comment

Choose a reason for hiding this comment

Uh oh!

kkashilk Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

kkashilk Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

nirajchowdhary Sep 24, 2025

Choose a reason for hiding this comment

Uh oh!

kkashilk Sep 23, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nirajchowdhary commented Sep 23, 2025 •

edited

Loading

On running /tools displays MCP tools from `quip-server` showed as "not trusted"

On running /tools displays MCP tools from `quip-server` showed as "not trusted"

On running /tools displays MCP tools from `quip-server` showed as "not trusted"