oz0 mcp clients policy
For: Operators and developers looking up a command.
Without flags, shows the tenant's allowlist. By default only clients that register with loopback redirect addresses (http://127.0.0.1, http://[::1] or http://localhost, programs on the person's own computer) may connect. --allow adds an entry and --disallow removes one: a host (clients.example.com, or *.example.com for the hosts under it) whose client metadata documents the edge may fetch, the exact URL of one such document (https://...), or scheme:<name> for a private-use redirect scheme such as scheme:com.example.app. --loopback off lets only listed clients in.
Allowing more is a loosening of a governance setting (mcp_clients): it takes --reason, and waits for a second admin when the tenant has four eyes on. Removing an entry or turning loopback off revokes the grants of the clients the list no longer allows. The edge fetches a metadata document only for a listed host or URL, only from public addresses, at most 5 KiB within 5 seconds.
Usage
oz0 mcp clients policy [--tenant T] [--loopback on|off] [--allow ENTRY]... [--disallow ENTRY]... --reason <why> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--allow | stringArray | a client host, a client metadata document's URL, or scheme:<name> to allow (repeat for more) | |
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--disallow | stringArray | an entry to remove (repeat for more) | |
--json | bool | print JSON instead of a table | |
--loopback | string | on or off: whether clients registered with loopback redirect addresses may connect | |
--reason | string | why, required for every change (default $OZ0_REASON); the audit log keeps it | |
--tenant | string | default | tenant |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.