@@ -231,6 +231,16 @@ connect, handshake or `tools/list`) is a configuration fault instead: the
 instance is degraded naming the refusal, as described under *A credential the
 upstream refuses* below.
 
+`include` has the same allowlist meaning as the `openapi` provider's: list the
+tools the instance should expose and every other tool stays out — the way to
+keep a destructive tool away from your flows and agents. It must be an array of
+tool names; any other shape (a string such as `include: 'web_search'`, an
+object) fails the boot before connecting, and never falls back to exposing
+every tool. An entry the server's `tools/list` does not carry — a typo, or a
+tool the server renamed or dropped — fails the boot with an error naming the
+entry and listing the server's tools; it is never ignored. Leave `include` out
+to expose every tool.
+
 <Callout type="warn">
 **Declarative stdio transports are denied by default.** Materializing one
 spawns a local process *from metadata* — which a runtime Studio publish can