diff --git a/src/roots.test.ts b/src/roots.test.ts
index 90bdaa24..d30e3d1a 100644
--- a/src/roots.test.ts
+++ b/src/roots.test.ts
@@ -1,7 +1,12 @@
 import assert from "node:assert/strict";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
-import { assertAllowedPath, expandHomePath, resolveAllowedPath } from "./roots.js";
+import {
+  AccessDeniedError,
+  assertAllowedPath,
+  expandHomePath,
+  resolveAllowedPath,
+} from "./roots.js";
 
 const home = homedir();
 
@@ -25,6 +30,21 @@ assert.equal(
   resolve("/workspace", "~/file.txt"),
 );
 
+const rejectedPath = resolve(home, "outside", "project");
+const allowedRoots = [resolve(home, "personal"), resolve(home, "work")];
+assert.throws(
+  () => assertAllowedPath(rejectedPath, allowedRoots),
+  (error: unknown) => {
+    assert.ok(error instanceof AccessDeniedError);
+    assert.equal(
+      error.message,
+      `Path is outside allowed roots: ${rejectedPath}\nAllowed roots:\n` +
+        allowedRoots.map((root) => `- ${root}`).join("\n"),
+    );
+    return true;
+  },
+);
+
 if (process.platform === "win32") {
   assert.throws(
     () => assertAllowedPath("C:\\Users\\Administrator", ["G:\\Projects\\Dev\\Github\\devspace"]),
diff --git a/src/roots.ts b/src/roots.ts
index 214ffb2b..2c91bf33 100644
--- a/src/roots.ts
+++ b/src/roots.ts
@@ -37,7 +37,9 @@ export function assertAllowedPath(path: string, allowedRoots: string[]): string
     return resolvedPath;
   }
 
-  throw new AccessDeniedError(`Path is outside allowed roots: ${path}`);
+  throw new AccessDeniedError(
+    `Path is outside allowed roots: ${path}\nAllowed roots:\n${allowedRoots.map((root) => `- ${root}`).join("\n")}`,
+  );
 }
 
 export function resolveAllowedPath(inputPath: string, cwd: string, allowedRoots: string[]): string {
diff --git a/src/server.test.ts b/src/server.test.ts
index 73eaf03b..4cb05061 100644
--- a/src/server.test.ts
+++ b/src/server.test.ts
@@ -2,7 +2,7 @@ import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
 import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import test, { type TestContext } from "node:test";
 import { promisify } from "node:util";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -16,6 +16,21 @@ import { WorkspaceRegistry } from "./workspaces.js";
 
 const execFileAsync = promisify(execFile);
 
+test("list_allowed_roots exposes configured workspace choices without opening a workspace", async (t) => {
+  const context = await fixture(t);
+  const result = await context.client.callTool({
+    name: "list_allowed_roots",
+    arguments: {},
+  });
+
+  assert.deepEqual(structuredContent(result).roots, [{
+    name: basename(context.config.allowedRoots[0]!),
+    path: context.config.allowedRoots[0],
+  }]);
+  assert.match(responseText(result), /Allowed workspace roots:/);
+  assert.doesNotMatch(responseText(result), /project instructions/);
+});
+
 test("open_workspace keeps lifecycle flags out of model output and preserves complete card metadata", async (t) => {
   const context = await fixture(t);
   const first = await callOpen(context.client, context.project, "chat-1");
diff --git a/src/server.ts b/src/server.ts
index 840594ab..e5d182e2 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { access, realpath } from "node:fs/promises";
+import { basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
@@ -165,6 +166,7 @@ function toolWidgetDescriptorMeta(
 }
 
 const toolNames = {
+  listAllowedRoots: "list_allowed_roots",
   openWorkspace: "open_workspace",
   read: "read",
   write: "write",
@@ -198,9 +200,10 @@ function serverInstructions(config: ServerConfig): string {
     config.widgets === "changes"
       ? " If the turn successfully modifies files by creating, editing, overwriting, deleting, moving, or applying patches, call show_changes exactly once for that workspace after the final related file change and before your final response so the user can inspect the aggregate diff for that turn. Do not call it after every individual file change; do not skip it because individual file-change tools already returned diffs."
       : "";
+  const rootDiscovery = `When the user has not identified the exact local project directory, call ${toolNames.listAllowedRoots} before ${toolNames.openWorkspace}; select only a listed root or a directory under it and never guess a filesystem path. `;
 
   if (config.toolMode === "codex") {
-    return `Use DevSpace for coding work. Call ${toolNames.openWorkspace} once for each project folder or isolated worktree, then keep using its workspaceId. During continued work in the same project or worktree, do not call ${toolNames.openWorkspace} again. Open another workspace only when changing projects, switching checkout/worktree mode, creating another isolated worktree, or when the current workspaceId is rejected. Use ${toolNames.read} for direct file reads, apply_patch for all file modifications, exec_command for inspection, tests, builds, and other commands, and write_stdin to poll or interact with running processes. Follow instructions returned by ${toolNames.openWorkspace}; read applicable instruction and skill files before working in their scope.${artifactInstruction}${showChangesInstruction}`;
+    return `Use DevSpace for coding work. ${rootDiscovery}Call ${toolNames.openWorkspace} once for each project folder or isolated worktree, then keep using its workspaceId. During continued work in the same project or worktree, do not call ${toolNames.openWorkspace} again. Open another workspace only when changing projects, switching checkout/worktree mode, creating another isolated worktree, or when the current workspaceId is rejected. Use ${toolNames.read} for direct file reads, apply_patch for all file modifications, exec_command for inspection, tests, builds, and other commands, and write_stdin to poll or interact with running processes. Follow instructions returned by ${toolNames.openWorkspace}; read applicable instruction and skill files before working in their scope.${artifactInstruction}${showChangesInstruction}`;
   }
 
   const inspection = config.toolMode !== "full"
@@ -213,7 +216,7 @@ function serverInstructions(config: ServerConfig): string {
 
   const agentsMd = `Follow instructions returned by ${toolNames.openWorkspace}. Before working under a path listed in availableAgentsFiles, use ${toolNames.read} to inspect that instruction file and follow it. `;
 
-  return `Use DevSpace for coding work. Call ${toolNames.openWorkspace} once for each project folder or isolated worktree, then keep using its workspaceId. During continued work in the same project or worktree, do not call ${toolNames.openWorkspace} again. Open another workspace only when changing projects, switching checkout/worktree mode, creating another isolated worktree, or when the current workspaceId is rejected. ${agentsMd}${skills}${inspection}Prefer ${toolNames.edit} for targeted modifications, ${toolNames.write} only for new files or complete rewrites, and ${toolNames.shell} for tests, builds, git inspection, package scripts, and commands that are better executed by the shell. Do not create or modify files with ${toolNames.shell}; avoid shell redirection, heredocs, tee, sed -i, perl -i, node/python/ruby scripts, or any command whose purpose is to write project files.${artifactInstruction}${showChangesInstruction}`;
+  return `Use DevSpace for coding work. ${rootDiscovery}Call ${toolNames.openWorkspace} once for each project folder or isolated worktree, then keep using its workspaceId. During continued work in the same project or worktree, do not call ${toolNames.openWorkspace} again. Open another workspace only when changing projects, switching checkout/worktree mode, creating another isolated worktree, or when the current workspaceId is rejected. ${agentsMd}${skills}${inspection}Prefer ${toolNames.edit} for targeted modifications, ${toolNames.write} only for new files or complete rewrites, and ${toolNames.shell} for tests, builds, git inspection, package scripts, and commands that are better executed by the shell. Do not create or modify files with ${toolNames.shell}; avoid shell redirection, heredocs, tee, sed -i, perl -i, node/python/ruby scripts, or any command whose purpose is to write project files.${artifactInstruction}${showChangesInstruction}`;
 }
 
 function formatVisibleAgent(agent: {
@@ -749,6 +752,38 @@ export function createMcpServer(
     },
   );
 
+  registerAppTool(
+    server,
+    toolNames.listAllowedRoots,
+    {
+      title: "List allowed workspace roots",
+      description:
+        "List local directories approved as workspace roots. Use this before open_workspace when the user has not identified the exact project directory. This reveals configured root paths only; it does not inspect their contents or grant access outside them.",
+      inputSchema: {},
+      outputSchema: {
+        roots: z.array(z.object({
+          name: z.string(),
+          path: z.string(),
+        })),
+      },
+      _meta: {},
+      annotations: { readOnlyHint: true },
+    },
+    async () => {
+      const roots = config.allowedRoots.map((path) => ({
+        name: basename(path) || path,
+        path,
+      }));
+      return {
+        content: [textBlock(
+          `Allowed workspace roots:\n${roots.map((root) => `- ${root.name}: ${root.path}`).join("\n")}`,
+        )],
+        _meta: { tool: toolNames.listAllowedRoots },
+        structuredContent: { roots },
+      };
+    },
+  );
+
   registerAppTool(
     server,
     "open_workspace",