diff --git a/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java b/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java
index 45516233d879..1c1de815b35c 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/server/Tool.java
@@ -26,6 +26,7 @@
 
 import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
 
 /**
  * The base class for MCP tools.
@@ -110,6 +111,8 @@ protected ObjectMapper getObjectMapper() {
         return objectMapper;
     }
 
+    public abstract Set<String> checkedPermissions();
+
     @JsonProperty
     public String name() {
         return name;
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java
index 324ca78e75a4..e2dd51f57c76 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/AggregateMessagesTool.java
@@ -79,6 +79,11 @@ You can scope the search to streams (by passing their IDs) or stream categories,
         this.scriptingApiService = scriptingApiService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public TabularResponse apply(PermissionHelper permissionHelper, AggregateMessagesTool.Parameters parameters) {
         try {
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java
index e650f9560b85..3963f37983ce 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/CurrentTimeTool.java
@@ -27,6 +27,8 @@
 import org.joda.time.DateTime;
 import org.joda.time.DateTimeZone;
 
+import java.util.Set;
+
 import static org.graylog2.shared.utilities.StringUtils.f;
 
 /**
@@ -60,6 +62,11 @@ public CurrentTimeTool(final CustomizationConfig customizationConfig,
         );
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, CurrentTimeTool.Parameters unused) {
         return Tools.getISO8601String(DateTime.now(DateTimeZone.UTC));
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java
index 8b81861c389b..ec16d72495c2 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListFieldsTool.java
@@ -66,6 +66,11 @@ Fields can have different meanings in different streams (and also per source), s
         this.mappedFieldTypesService = mappedFieldTypesService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public Result apply(final PermissionHelper permissionHelper, final ListFieldsTool.Parameters parameters) {
         final Set<String> messageStreamIds = permissionHelper.getSearchUser().streams().loadAllMessageStreams();
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java
index f1c58d74341b..fc833311bb9b 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndexSetsTool.java
@@ -35,6 +35,7 @@
 import java.io.PrintWriter;
 import java.io.StringWriter;
 import java.util.Comparator;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -69,6 +70,11 @@ retention settings (how long data is kept), index prefix patterns, and current s
         this.customizationConfig = customizationConfig;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.INDEXSETS_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ListIndexSetsTool.Parameters unused) {
         // TODO: find a better way to do this. This is all from org.graylog2.rest.resources.system.indexer.IndexSetsResource
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java
index ce3c763a6714..9f2ed1712717 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListIndicesTool.java
@@ -21,10 +21,10 @@
 import jakarta.inject.Inject;
 import org.graylog.mcp.server.SchemaGeneratorProvider;
 import org.graylog.mcp.server.Tool;
-import org.graylog2.indexer.indexset.IndexSet;
-import org.graylog2.indexer.indexset.registry.IndexSetRegistry;
 import org.graylog2.indexer.NodeInfoCache;
+import org.graylog2.indexer.indexset.IndexSet;
 import org.graylog2.indexer.indexset.index.IndexPattern;
+import org.graylog2.indexer.indexset.registry.IndexSetRegistry;
 import org.graylog2.indexer.indices.Indices;
 import org.graylog2.indexer.indices.stats.IndexStatistics;
 import org.graylog2.indexer.indices.util.NumberBasedIndexNameComparator;
@@ -85,6 +85,11 @@ public ListIndicesTool(Indices indices,
         this.indexSetRegistry = indexSetRegistry;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.INDICES_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ListIndicesTool.Parameters unused) {
         final var all = AllIndices.create(closed(permissionHelper), reopened(permissionHelper), open(permissionHelper));
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java
index 0f7f67675a8f..757770900a3d 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListInputsTool.java
@@ -38,6 +38,7 @@
 import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -74,6 +75,11 @@ public ListInputsTool(InputService inputService,
         this.customizationConfig = customizationConfig;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.INPUTS_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ListInputsTool.Parameters unused) {
         StringWriter sw = new StringWriter();
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java
index 5128f4659587..2002561792ab 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListResourceTool.java
@@ -31,6 +31,7 @@
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -57,6 +58,11 @@ public ListResourceTool(ObjectMapper objectMapper,
         this.resourceProviders = resourceProviders;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public ListResourceTool.Result apply(PermissionHelper permissionHelper, ListResourceTool.Parameters parameters) {
         GRNType grnType = switch (parameters.type.toLowerCase(Locale.US).replace(' ', '_')) {
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java
index 5c28b3d85b7d..0ac828d8875d 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ListStreamsTool.java
@@ -29,6 +29,7 @@
 
 import java.util.Map;
 import java.util.Objects;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -57,6 +58,11 @@ public ListStreamsTool(StreamService streamService,
         this.streamService = streamService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.STREAMS_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ListStreamsTool.Parameters unused) {
         try (var dtos = streamService.streamAllDTOs()) {
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java
index d2fc81e72884..9fc1735b8835 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/ReadResourceTool.java
@@ -30,6 +30,7 @@
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Map;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -56,6 +57,11 @@ public ReadResourceTool(ObjectMapper objectMapper,
         this.resourceProviders = resourceProviders;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, ReadResourceTool.Parameters parameters) {
         try {
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java
index 9be5bce47db5..5aeee343f3e8 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SearchMessagesTool.java
@@ -77,6 +77,11 @@ You can scope the search to streams (by passing their IDs) or stream categories,
         this.scriptingApiService = scriptingApiService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of();
+    }
+
     @Override
     public TabularResponse apply(PermissionHelper permissionHelper, SearchMessagesTool.Parameters parameters) {
         try {
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java
index 54e8f1af058b..6009b84788cc 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoFormattedTool.java
@@ -32,6 +32,7 @@
 
 import java.util.List;
 import java.util.Locale;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -63,6 +64,11 @@ public SystemInfoFormattedTool(ObjectMapper objectMapper,
         this.leaderElectionService = leaderElectionService;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.SYSTEM_READ);
+    }
+
     @Override
     public String apply(PermissionHelper permissionHelper, SystemInfoFormattedTool.Parameters unused) {
         try {
diff --git a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java
index bc2d983fd1a1..e59489e69586 100644
--- a/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java
+++ b/graylog2-server/src/main/java/org/graylog/mcp/tools/SystemInfoTool.java
@@ -31,6 +31,7 @@
 import org.graylog2.web.customization.CustomizationConfig;
 
 import java.util.Locale;
+import java.util.Set;
 
 import static org.graylog2.shared.utilities.StringUtils.f;
 
@@ -66,6 +67,11 @@ public SystemInfoTool(ServerStatus serverStatus,
         this.customizationConfig = customizationConfig;
     }
 
+    @Override
+    public Set<String> checkedPermissions() {
+        return Set.of(RestPermissions.SYSTEM_READ);
+    }
+
     @Override
     public SystemOverviewResponse apply(PermissionHelper permissionHelper, SystemInfoTool.Parameters unused) {
         try {