The message "Tool is not enabled for this tenant" means the tool exists on Safeguard's MCP server but your workspace has not turned it on. Copy the tool name from the message and ask a Safeguard administrator to enable it under Feature Flags. After that, wait about a minute and restart your assistant session.
What the error looks like
The server does not break the connection. It returns a normal tool result with an error flag set. Most assistants show the text directly. A typical shape is:
{
"content": [
{
"type": "text",
"text": "Tool \"safeguard_scan_manifest\" is not enabled for this tenant. An administrator can enable it via MCP tool feature flags."
}
],
"isError": true
}
Because it is a tool result and not a transport error, the rest of the session keeps working. Other tools that are enabled still run.
Why it happens
Each MCP tool has its own feature flag. The server resolves the set enabled for your tenant and uses that same set in two places: the list of tools it advertises, and the check on each call. That means an assistant should not normally see a tool it cannot call. If the assistant tries anyway, perhaps from a cached list or from memory of another workspace, the call is rejected with this message.
Everything outside the six default read-only tools starts off. Scanning, integrations, billing, notifications and admin tools are all opt in.
Fix it in five steps
- Copy the exact tool name from the error.
- Send it to whoever administers your Safeguard tenant. Feature Flags is an administrative screen, not a self service toggle.
- The administrator searches Feature Flags for the name, or filters by the mcp category, toggles it on and saves.
- Wait about a minute. Resolution is cached briefly.
- Restart or reconnect your assistant, since many clients cache the tool list for the session.
If you do not know the name
Tool names follow the pattern safeguard, a verb, then a noun. Examples include safeguard_scan_manifest and safeguard_list_sboms. If you only know the capability, search Feature Flags for a keyword such as sbom or secrets. You can also ask your assistant what it can currently do.
What it does not mean
It does not mean your login failed, your key was revoked, or the server is down. Those problems stop the connection or return an authentication failure. See OAuth or MCP key: which to use for those cases.
It also does not mean a per user restriction. Gating is per tenant, so everyone in the same tenant, organization and product context gets the same set.
A note for administrators
Enabling a tool is a deliberate decision. Read tools are low risk. Tools that add integrations or start scans change state. Start narrow and widen as trust grows. The staged rollout guide suggests an order.
Quick check
Can I enable a tool for just one person?
Not through tool gating. It resolves per tenant. Finer control over agent behavior is what Guard policies are for.
Is isError a connection failure?
No. It is a normal tool result with an error flag, so the session continues.
Sources
Last reviewed: 19 October 2026.
