@@ -29,6 +29,7 @@ import { ComingSoon, type ComingSoonInfo } from './pages/coming-soon';
 import { TabIcon } from './pages/tab-icon';
 import { styleHubRail } from './hub-rail-style';
 import { followHubDocks, selectHubDock } from './hub-dock-sync';
+import { panelConfig, tabEnabled } from './devtools-config';
 
 const HUB_VIEWS = ['angular', 'ngrx', 'analog', 'nativescript', 'capacitor'] as const;
 
@@ -250,6 +251,10 @@ function readView(): View | null {
         </p>
       } @else if (comingSoon(); as info) {
         <app-coming-soon [info]="info" />
+      } @else if (!tabEnabled(tab(), config())) {
+        <p class="turned-off">
+          This inspector is turned off in the devtools config (<code>inspectors</code>).
+        </p>
       } @else {
         @switch (tab()) {
           @case ('dashboard') {
@@ -559,6 +564,15 @@ function readView(): View | null {
     main > * {
       animation: enter 0.28s var(--ease) both;
     }
+    .turned-off {
+      max-width: 60ch;
+      margin: 0;
+      padding: 12px 14px;
+      border: 1px solid var(--border);
+      border-radius: var(--radius);
+      background: var(--surface);
+      color: var(--text);
+    }
     .connection-error {
       max-width: 60ch;
       margin: 0;
@@ -624,12 +638,15 @@ export class App implements OnInit, OnDestroy {
     if (view === 'analog') return this.analogKnown() && !this.analog() ? NOT_ANALOG : undefined;
     return view ? COMING_SOON[view] : undefined;
   });
+  readonly config = computed(() => panelConfig(this.rpc()));
+  protected readonly tabEnabled = tabEnabled;
   readonly tabs = computed(() => {
     if (this.comingSoon()) return [];
     const view = this.view();
     const only = view ? VIEW_TAB[view] : undefined;
-    if (only) return this.allTabs.filter((t) => t.id === only);
-    return this.allTabs.filter(
+    const enabled = this.allTabs.filter((t) => tabEnabled(t.id, this.config()));
+    if (only) return enabled.filter((t) => t.id === only);
+    return enabled.filter(
       (t) => (t.id !== 'analog' || this.analog()) && !(view === 'angular' && TAB_VIEW[t.id]),
     );
   });
@@ -766,7 +783,7 @@ export class App implements OnInit, OnDestroy {
     if (message?.type !== 'ng-devtools:inspect-component' || typeof message.id !== 'string') return;
     // Any element inside the app resolves to a component, so following every
     // Elements selection would pull the user off whichever tab they are on.
-    if (this.tab() !== 'components') return;
+    if (this.tab() !== 'components' || !this.config().inspectors.components) return;
     this.componentFocus.set({ id: message.id });
   }
 
 
@@ -0,0 +1,37 @@
+import type { DevframeRpcClient } from 'devframe/client';
+import {
+  actionBlockedMessage,
+  configFromConnection,
+  type NgDevtoolsAction,
+  type NgDevtoolsInspector,
+  type ResolvedNgDevtoolsConfig,
+} from '@santoshyadavdev/ng-devtools/config';
+import type { Tab } from './types/tab.types';
+
+export { actionBlockedMessage };
+
+/** The config the server published in its connection info; everything is on without one. */
+export function panelConfig(client: DevframeRpcClient | null): ResolvedNgDevtoolsConfig {
+  return configFromConnection(client?.connectionMeta);
+}
+
+export function actionAllowed(client: DevframeRpcClient | null, action: NgDevtoolsAction): boolean {
+  return panelConfig(client).actions[action];
+}
+
+const TAB_INSPECTOR: Partial<Record<Tab, NgDevtoolsInspector>> = {
+  components: 'components',
+  routes: 'router',
+  signals: 'signals',
+  injectors: 'injectors',
+  store: 'ngrx',
+  forms: 'forms',
+  pipes: 'pipes',
+  network: 'http',
+  analog: 'analog',
+};
+
+export function tabEnabled(tab: Tab, config: ResolvedNgDevtoolsConfig): boolean {
+  const inspector = TAB_INSPECTOR[tab];
+  return !inspector || config.inspectors[inspector];
+}
@@ -11,6 +11,7 @@ import {
 import type { DevframeRpcClient } from 'devframe/client';
 import { time } from '../format';
 import { rpcTry as call } from '../rpc';
+import { actionAllowed, actionBlockedMessage } from '../devtools-config';
 import { Select } from '../ui/select';
 
 interface AnalogRoute {
@@ -619,8 +620,18 @@ function walk(routes: AnalogRoute[], depth = 0, out: { route: AnalogRoute; depth
                   [value]="apiPath()"
                   (input)="apiPath.set($any($event.target).value)"
                 />
-                <button type="submit" class="btn primary">Send</button>
+                <button
+                  type="submit"
+                  class="btn primary"
+                  [disabled]="!canCall()"
+                  [attr.aria-describedby]="canCall() ? null : 'analog-calls-off'"
+                >
+                  Send
+                </button>
               </div>
+              @if (!canCall()) {
+                <p id="analog-calls-off" class="muted">{{ callsOff }}</p>
+              }
               @if (method() !== 'GET') {
                 <label for="api-body">JSON body</label>
                 <textarea
@@ -1819,6 +1830,8 @@ function walk(routes: AnalogRoute[], depth = 0, out: { route: AnalogRoute; depth
 })
 export class AnalogInspector {
   rpc = input<DevframeRpcClient | null>(null);
+  readonly canCall = computed(() => actionAllowed(this.rpc(), 'analog'));
+  protected readonly callsOff = actionBlockedMessage('analog');
 
   readonly kinds: Kind[] = ['all', 'page', 'load', 'fn', 'api'];
   readonly methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
 
@@ -9,7 +9,12 @@ import {
   signal,
 } from '@angular/core';
 import type { DevframeRpcClient } from 'devframe/client';
+import {
+  summarizeNgDevtoolsConfig,
+  type ResolvedNgDevtoolsConfig,
+} from '@santoshyadavdev/ng-devtools/config';
 import { hostPageId } from '../page-id';
+import { panelConfig, tabEnabled } from '../devtools-config';
 import { TabIcon } from './tab-icon';
 
 type LoadState = 'loading' | 'ready' | 'error';
@@ -160,7 +165,7 @@ export function storeCard(rows: Row[]): Card {
     </section>
 
     <div class="grid">
-      @for (stat of stats; track stat.tab; let i = $index) {
+      @for (stat of stats(); track stat.tab; let i = $index) {
         @let state = stateOf(stat.tab);
         <button
           type="button"
@@ -191,6 +196,22 @@ export function storeCard(rows: Row[]): Card {
         </button>
       }
     </div>
+
+    <section class="config" aria-labelledby="config-title">
+      <h2 id="config-title">Configuration</h2>
+      @if (configItems().length) {
+        <dl>
+          @for (item of configItems(); track item.label) {
+            <div>
+              <dt>{{ item.label }}</dt>
+              <dd>{{ item.value }}</dd>
+            </div>
+          }
+        </dl>
+      } @else {
+        <p>Defaults</p>
+      }
+    </section>
   `,
   styles: `
     @use 'mixins' as m;
@@ -384,6 +405,45 @@ export function storeCard(rows: Row[]): Card {
       font-size: 12px;
       line-height: 16px;
     }
+    .config {
+      margin-top: 16px;
+      padding: 16px;
+      border: 1px solid var(--border);
+      border-radius: var(--radius);
+      background: var(--surface);
+    }
+    .config h2 {
+      @include m.label;
+      margin: 0 0 8px;
+      color: var(--text-2);
+    }
+    .config p,
+    .config dl {
+      margin: 0;
+      color: var(--text);
+      font-size: 13px;
+      line-height: 1.5;
+    }
+    .config dl {
+      display: grid;
+      gap: 4px;
+    }
+    .config dl div {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 4px 8px;
+    }
+    .config dt {
+      color: var(--text-2);
+    }
+    .config dt::after {
+      content: ':';
+    }
+    .config dd {
+      margin: 0;
+      color: var(--text-strong);
+      overflow-wrap: anywhere;
+    }
     @keyframes shimmer {
       to {
         background-position: -200% 0;
@@ -424,7 +484,11 @@ export class Dashboard {
   navigate = output<StatTab>();
 
   meta = signal<BuildMeta | null>(null);
-  protected readonly stats = STATS;
+  private readonly config = computed(() => panelConfig(this.rpc()));
+  protected readonly stats = computed(() =>
+    STATS.filter((stat) => tabEnabled(stat.tab, this.config())),
+  );
+  protected readonly configItems = computed(() => summarizeNgDevtoolsConfig(this.config()));
   protected readonly metaState = signal<LoadState>('loading');
   protected readonly states = signal<Partial<Record<StatTab, LoadState>>>({});
   private readonly rows = signal<Partial<Record<StatTab, Row[]>>>({});
@@ -510,13 +574,15 @@ export class Dashboard {
           this.metaState.set('ready');
         })
         .catch(() => this.metaState.set('error'));
-      this.load(my.rpc.call('get-components'), 'components');
-      this.load(my.rpc.call('get-routes'), 'routes');
-      this.load(my.rpc.call('get-signals'), 'signals');
-      this.load(my.rpc.call('get-providers'), 'injectors');
-      this.load(my.rpc.call('get-ngrx-store'), 'store');
-      this.load(my.rpc.call('get-pipes'), 'pipes');
-      void this.watchLive(client);
+      const config = panelConfig(client);
+      const on = (tab: StatTab) => tabEnabled(tab, config);
+      if (on('components')) this.load(my.rpc.call('get-components'), 'components');
+      if (on('routes')) this.load(my.rpc.call('get-routes'), 'routes');
+      if (on('signals')) this.load(my.rpc.call('get-signals'), 'signals');
+      if (on('injectors')) this.load(my.rpc.call('get-providers'), 'injectors');
+      if (on('store')) this.load(my.rpc.call('get-ngrx-store'), 'store');
+      if (on('pipes')) this.load(my.rpc.call('get-pipes'), 'pipes');
+      void this.watchLive(client, config);
     });
     this.destroyRef.onDestroy(() => this.unwatch());
   }
@@ -537,7 +603,7 @@ export class Dashboard {
       .catch(() => mark('error'));
   }
 
-  private async watchLive(client: DevframeRpcClient) {
+  private async watchLive(client: DevframeRpcClient, config: ResolvedNgDevtoolsConfig) {
     this.unwatch();
     const rpc = client.scope('ng-devtools').rpc;
     const follow = async <T>(
@@ -554,8 +620,10 @@ export class Dashboard {
       }
     };
     await Promise.all([
-      follow<InjectorSnapshot | null>('injector-tree', (value) => this.injectorTree.set(value)),
-      follow<GraphSnapshot | null>('signal-graph', (value) => this.signalGraph.set(value)),
+      config.inspectors.injectors &&
+        follow<InjectorSnapshot | null>('injector-tree', (value) => this.injectorTree.set(value)),
+      config.inspectors.signals &&
+        follow<GraphSnapshot | null>('signal-graph', (value) => this.signalGraph.set(value)),
     ]);
   }
 
 
@@ -9,6 +9,7 @@ import {
   type CollectedForm,
   type FormFieldNode,
 } from './forms-types';
+import { actionAllowed, actionBlockedMessage } from '../devtools-config';
 
 @Component({
   selector: 'app-forms-field-detail',
@@ -33,15 +34,42 @@ import {
           (input)="draft.set($any($event.target).value)"
           (keydown.enter)="setValue()"
         />
-        <button type="button" class="small primary" (click)="setValue()">Set</button>
+        <button
+          type="button"
+          class="small primary"
+          [disabled]="!canWrite()"
+          [attr.aria-describedby]="canWrite() ? null : 'field-writes-off'"
+          (click)="setValue()"
+        >
+          Set
+        </button>
       </div>
     }
     <div class="row" role="group" aria-label="Field actions">
       <button type="button" class="small" (click)="act('focus')">Focus</button>
-      <button type="button" class="small" (click)="act('mark-touched')">Touch</button>
-      <button type="button" class="small" (click)="act('revalidate')">Revalidate</button>
+      <button
+        type="button"
+        class="small"
+        [disabled]="!canWrite()"
+        [attr.aria-describedby]="canWrite() ? null : 'field-writes-off'"
+        (click)="act('mark-touched')"
+      >
+        Touch
+      </button>
+      <button
+        type="button"
+        class="small"
+        [disabled]="!canWrite()"
+        [attr.aria-describedby]="canWrite() ? null : 'field-writes-off'"
+        (click)="act('revalidate')"
+      >
+        Revalidate
+      </button>
       <button type="button" class="small" (click)="act('store-as-global')">Store as global</button>
     </div>
+    @if (!canWrite()) {
+      <p id="field-writes-off" class="muted">{{ writesOff }}</p>
+    }
     <p class="status" role="status">{{ message() }}</p>
   `,
   styles: `
@@ -106,6 +134,8 @@ export class FormsFieldDetail {
   version = input(0);
   rpc = input<DevframeRpcClient | null>(null);
 
+  readonly canWrite = computed(() => actionAllowed(this.rpc(), 'forms'));
+  protected readonly writesOff = actionBlockedMessage('forms');
   readonly text = signal('');
   private readonly target = computed(() => `${this.form().id}|${this.node().path}`);
   readonly draft = linkedSignal({ source: this.target, computation: () => '' });