Add a tool limit

Start with the basic connection. Review its run. Then choose the tools that the agent needs.

Allow read and search

writ connect codex --read-only

This profile allows tools that Writ normalizes as read or search. It stops write, edit, shell, and other tool calls.

The name --read-only describes the allowed action classes. Writ does not inspect the final effect of a tool.

Or allow exact tools

writ connect codex \
  --allow read \
  --allow search \
  --allow mcp__github__get_issue

Each value must match the exact tool name reported by the agent or Writ’s normalized name. Use the basic record or the agent’s tool list to find the provider name.

Do not combine --read-only and --allow.

Decide a stopped call

A call outside the tool limit creates an approval request. Writ does not run the call.

writ approvals
writ approve <request-id>

Ask the agent to retry the call. The default approval permits one call with the same tool name and argument digest.

Permit matching retries for the current agent session when needed:

writ approve <request-id> --scope run

Or deny the request:

writ deny <request-id> --reason "This tool is outside the task."

Every request and decision remains in the record.

The default limit applies to the user connection. Add --project when the limit should apply only in the current project:

writ connect codex --read-only --project

When both scopes exist, a call must pass both limits.

Check the active limit

writ connect status codex

The four coverage rows now show enforcing where the hook can stop calls. limited or not visible still applies where the agent does not provide a complete pre-tool event.

Use Run one bounded task when you also need model-cost limits, workspace invariants, or completion checks.