---
title: "oz0 mcp clients policy"
description: "Without flags, shows the tenant's allowlist."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/mcp/clients/policy"
---
# oz0 mcp clients policy

> Without flags, shows the tenant's allowlist.

For: Operators and developers looking up a command.

Without flags, shows the tenant's allowlist. By default only clients that register with loopback redirect addresses (`http://127.0.0.1`, `http://[::1]` or `http://localhost`, programs on the person's own computer) may connect. --allow adds an entry and --disallow removes one: a host (clients.example.com, or *.example.com for the hosts under it) whose client metadata documents the edge may fetch, the exact URL of one such document (`https://...`), or scheme:\<name> for a private-use redirect scheme such as scheme:com.example.app. --loopback off lets only listed clients in.

Allowing more is a loosening of a governance setting (mcp_clients): it takes --reason, and waits for a second admin when the tenant has four eyes on. Removing an entry or turning loopback off revokes the grants of the clients the list no longer allows. The edge fetches a metadata document only for a listed host or URL, only from public addresses, at most 5 KiB within 5 seconds.

## Usage

```bash
oz0 mcp clients policy [--tenant T] [--loopback on|off] [--allow ENTRY]... [--disallow ENTRY]... --reason <why> [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --allow
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      a client host, a client metadata document's URL, or scheme:&lt;name> to allow (repeat for more)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --decision-ref
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the decision or case the change follows, such as a case number (at most 200 characters)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --disallow
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      an entry to remove (repeat for more)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      print JSON instead of a table
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --loopback
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      on or off: whether clients registered with loopback redirect addresses may connect
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      why, required for every change (default $OZ0_REASON); the audit log keeps it
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      tenant
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.