How to hide access to any endpoint except agents, and in agents users are not able to select mcp servers and tools by themselves?

[kuanyshbakytuly]

Using these config, I still have MCP-Server panel in the chat bar, so I am forced to click on panel and pick "clickhouse-playground".
How to init agent with mcp-server?

Configuration version

version: 1.2.1
cache: true

Lock down the interface - users can't change settings

interface:
endpointsMenu: false # Hide endpoint selection
modelSelect: false # Hide model selection
parameters: false # Hide parameter adjustments
presets: false # Hide presets
agents: true # Show agents interface
sidePanel: false # Hide side panel
prompts: false # Hide prompts library
bookmarks: false # Hide bookmarks

MCP Server Configuration

mcpServers:
clickhouse-playground:
type: sse
url: http://mcp-clickhouse:8000/sse
timeout: 60000
initTimeout: 10000
startup: true
autoConnect: true

Endpoints configuration

endpoints:

Agents endpoint configuration

agents:
# Disable the builder so users can't create/modify agents
disableBuilder: true
# Set recursion limits
recursionLimit: 25
maxRecursionLimit: 50
# Control capabilities - these will be available to all agents
capabilities: ["execute_code", "file_search", "actions", "tools"]

Custom endpoint for Claude model

custom:
- name: "CrabAgent"
apiKey: "${ANTHROPIC_API_KEY}"
baseURL: "https://api.anthropic.com/v1"
models:
default: ["claude-3-5-sonnet-20241022"]
fetch: false
modelDisplayLabel: "CrabDB Assistant"

Model specifications to force default selection

modelSpecs:
enforce: true
prioritize: true
list:
- name: "crabdb-default"
label: "CrabDB Assistant"
default: true
preset:
endpoint: "CrabAgent" # <-- Fixed: Just "CrabAgent", not "custom_CrabAgent"
model: "claude-3-5-sonnet-20241022"
modelLabel: "CrabDB Assistant"
promptPrefix: |
You are CrabDB Assistant with full access to ClickHouse database.
You have access to database query tools through MCP.
Always use these tools when answering database questions.

      Available tools:
      - Query execution via MCP ClickHouse server
      - Database schema exploration
      - Performance analysis
    
    temperature: 0.7
    top_p: 1
    top_k: 0
    frequency_penalty: 0
    presence_penalty: 0
    max_tokens: 4096

version: '3.8'

services:
sandpack-bundler:
image: ghcr.io/librechat-ai/codesandbox-client/bundler:latest
container_name: sandpack-bundler
ports:
- "${SANDPACK_PORT:-8080}:80"
networks:
- librechat_network
restart: unless-stopped

mongodb:
image: mongo:latest
container_name: librechat_mongodb
networks:
- librechat_network
volumes:
- ${MONGODB_DATA_DIR:-./services_data/mongodb_data}:/data/db
command: mongod --noauth
restart: unless-stopped

redis:
image: redis:alpine
container_name: librechat_redis
networks:
- librechat_network
command: redis-server --appendonly yes
volumes:
- ${REDIS_DATA_DIR:-./services_data/redis_data}:/data
restart: unless-stopped

mcp-clickhouse:
build: ./mcp-clickhouse
container_name: mcp-clickhouse
ports:
- "${MCP_PORT:-8001}:8000"
extra_hosts:
- "host.docker.internal:host-gateway"
environment:
- CLICKHOUSE_HOST=${CLICKHOUSE_HOST}
- CLICKHOUSE_PORT=${CLICKHOUSE_PORT}
- CLICKHOUSE_USER=${CLICKHOUSE_USER}
- CLICKHOUSE_PASSWORD=${CLICKHOUSE_PASSWORD}
- CLICKHOUSE_SECURE=${CLICKHOUSE_SECURE}
- CLICKHOUSE_VERIFY=${CLICKHOUSE_VERIFY}
- CLICKHOUSE_CONNECT_TIMEOUT=${CLICKHOUSE_CONNECT_TIMEOUT}
- CLICKHOUSE_SEND_RECEIVE_TIMEOUT=${CLICKHOUSE_SEND_RECEIVE_TIMEOUT}
- CLICKHOUSE_ENABLED=${CLICKHOUSE_ENABLED}
- CHDB_ENABLED=${CHDB_ENABLED}
- CLICKHOUSE_MCP_SERVER_TRANSPORT=sse
- CLICKHOUSE_MCP_BIND_HOST=0.0.0.0
- CLICKHOUSE_MCP_BIND_PORT=8000
networks:
- librechat_network
restart: unless-stopped
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s

librechat_api:
image: ghcr.io/danny-avila/librechat:latest
container_name: librechat_api
depends_on:
- mongodb
- redis
- mcp-clickhouse
- sandpack-bundler
networks:
- librechat_network
environment:
# Core settings
- JWT_SECRET=${JWT_SECRET}
- JWT_REFRESH_SECRET=${JWT_REFRESH_SECRET}
- CREDS_KEY=${CREDS_KEY}
- CREDS_IV=${CREDS_IV}
- MONGO_URI=${MONGO_URI}
- REDIS_URI=${REDIS_URI}
- APP_TITLE=${APP_TITLE}
- CUSTOM_FOOTER=${CUSTOM_FOOTER}
- SANDPACK_BUNDLER_URL=${SANDPACK_BUNDLER_URL}
- DOMAIN_CLIENT=${DOMAIN_CLIENT}
- DOMAIN_SERVER=${DOMAIN_SERVER}
- ALLOW_REGISTRATION=${ALLOW_REGISTRATION}
- ALLOW_SOCIAL_LOGIN=${ALLOW_SOCIAL_LOGIN}
- DEBUG_LOGGING=${DEBUG_LOGGING}
- ENDPOINTS=agents
- ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
- OPENAI_API_KEY=${OPENAI_API_KEY}
- MCP_ENABLED=true
- ALLOW_MCP=true
- MCP_AUTO_CONNECT=true
- DEBUG_MCP=true
- LOG_LEVEL=debug
volumes:
- ./librechat.yaml:/app/librechat.yaml
- ${LOGS_DIR:-./services_data/logs}:/app/api/logs
- ${UPLOADS_DIR:-./services_data/uploads}:/app/client/public/uploads
- ${IMAGES_DIR:-./services_data/images}:/app/client/public/images
ports:
- "${LIBRECHAT_PORT:-3080}:3080"
restart: unless-stopped
user: "0:0"

networks:
librechat_network:
driver: bridge

[kuanyshbakytuly]