Agent rules and permissions
Agent rules#
Write agent instructions once in the Agent rules tab instead of keeping CLAUDE.md, AGENTS.md, GEMINI.md and the rest in sync by hand.
- Rule sets — keep several ("Work", "Personal"); exactly one is active.
- Whole file — for clients that read a rules directory, Toolport owns its own
toolport-rules.md. - Marked block — for a shared file you also edit, Toolport only rewrites what is between its HTML-comment markers.
- Start from a file — import an existing rules file into a new set; the file is read, never written.
Every client starts switched off. Nothing is written until you tick a client in the Clients section of the Agent rules tab. If you edit Toolport's block by hand, the client shows Edited on disk with a diff and you choose which version wins.
Agent permissions#
The gateway governs MCP calls, but it cannot see what Claude Code does natively: shell commands, file edits, web fetches. The Agent permissions tab writes rules into the permissions lists of every Claude Code profile's settings.json, including profiles selected with CLAUDE_CONFIG_DIR.
| Action | Claude Code list | Meaning |
|---|---|---|
| Never | deny |
The call is refused |
| Ask first | ask |
Claude Code prompts first |
| Always allow | allow |
Runs without a prompt |
Patterns use Claude Code's own syntax: Bash(rm -rf *), Bash(git push --force*), Read(./.env), Edit(src/**/*.ts), WebFetch(domain:example.com). When several match, deny beats ask beats allow.
- Off and empty by default. Nothing is written until you turn the switch on.
- Preview shows the exact bytes each
settings.jsonwould hold; only thepermissionskey is rewritten. - Cursor has no settings-level rule list, so Toolport enforces the same rules there through a guard hook.
- Codex and Gemini CLI are not covered yet.