docs: add Restricting Tool Access section for MCP server

[Matovidlo]

Jira issue(s): N/A

Changes:

• Add new "Restricting Tool Access" section to MCP server documentation
• Document three HTTP headers for tool authorization: X-Allowed-Tools, X-Disallowed-Tools, and X-Read-Only-Mode
• Include use cases for AI agent restrictions, compliance/security, and customer-specific access
• Link to developers-docs for detailed technical documentation

Updates since last revision:

• Added clarification that headers are set by the client (e.g., AI agent integration or custom MCP client) when making HTTP requests, not through Keboola project settings

---

Link to Devin run: https://app.devin.ai/sessions/4ccc6d6f64aa49a6823bf2e09c8a5091
Requested by: Martin Vasko (@Matovidlo)

Related PRs:

• feat: add ToolAuthorizationMiddleware for granular tool access control mcp-server#350 - Implementation of tool authorization middleware
• docs: add Tool Authorization and Access Control section for MCP server developers-docs#364 - Detailed technical documentation

Human Review Checklist:

• Verify the link to developers-docs (https://developers.keboola.com/integrate/mcp/#tool-authorization-and-access-control) will work after the corresponding developers-docs PR is merged
• Confirm header names match the implementation in mcp-server PR Add azure datalake gen 2 docs #350
• Verify placement after "Available Tools" section is appropriate
• Verify the client-side header clarification is accurate per the implementation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[Copilot]

Pull request overview

This pull request adds documentation for a new "Restricting Tool Access" feature in the Keboola MCP server, allowing users to control which tools are available to AI agents through HTTP headers.

Changes:

• Adds a new "Restricting Tool Access" section documenting three HTTP headers for tool authorization (X-Allowed-Tools, X-Disallowed-Tools, X-Read-Only-Mode)
• Documents use cases for AI agent restrictions, compliance/security controls, and customer-specific access profiles
• Links to external developer documentation for detailed technical specifications

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.