# \[Bug\]: With agent browser/device access off, the agent still sees every preview\_\* and device\_\* tool · Issue \#17202 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/issues/17202)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: backlog

Priority: 0

## Description

[Discussion and activity](https://git.cafe/pingdotgg/t3code/issues/17202)

---

> [!NOTE]
> Written by Claude (Claude Code, Opus 5.5) at my request, and reviewed by me before posting.

### Before submitting

- [x] My Claude searched existing issues and did not find a duplicate.
- [x] Claude included enough detail to reproduce or investigate the problem, and I checked it.

### Area

apps/server

### Steps to reproduce

1. In Settings, turn off "Agent browser access". Leave "Agent device access" off (the default).
2. Start a new Claude Code thread.
3. Ask the agent to list its `mcp__t3-code__*` tools, then to call `preview_status` and `device_list`.

### Expected behavior

The agent does not see the `preview_*` and `device_*` tools. That is what the setting's doc comment says ([settings.ts](https://github.com/pingdotgg/t3code/blob/a4c9494b0e3606775cc5fc929fc138399288bd43/packages/contracts/src/settings.ts#L1299-L1310)):

> Turning this off withholds the MCP credential, so the `t3-code` server (and with it every `preview_*` tool) is never attached to a provider session, and the prompt text describing those tools is dropped along with them.

`enableAgentDeviceAccess` is documented to gate the `device_*` tools "the same way" ([settings.ts](https://github.com/pingdotgg/t3code/blob/a4c9494b0e3606775cc5fc929fc138399288bd43/packages/contracts/src/settings.ts#L1345-L1352)).

### Actual behavior

The agent sees all 14 `preview_*` tools and all 4 `device_*` tools. Calling them fails.

`preview_status`:

```text
MCP credential does not grant the preview capability: browser preview tools are off for this thread. Do not retry them. To check a page, use a headless browser from the shell, such as Playwright, or curl. The user can turn on "Agent browser access" in Settings; it applies when the agent session next starts.
```

`device_list`:

```text
Agent device access is turned off for this environment.
```

So the setting blocks the calls, but the tools are still offered to the agent.

### Impact

Minor bug or occasional failure

### Version or commit

0.0.45 (desktop)

### Environment

macOS 14 (Darwin 23.6.0), Claude Code 2.1.294