MCP server: tool permissions for members and API keys
Owners can control which MCP tools connected assistants can use from Config > PLATFORM > MCP server. The server enforces these permissions in every MCP client.
What Owners can set
Global settings limit tools for everyone, including Owners and API keys. With individual settings, an Owner can also give specific team members or API keys fewer tools. An Owner can change many members or keys at once and choose starting tools for new members.
Effect on existing access
Existing connections keep their access until an Owner saves restrictions. When an Owner first enables individual settings, existing members and API keys keep their tools. With individual settings enabled, a new API key has no MCP tools until an Owner allows them.
See Tool permissions for setup and limits.
Messaging embed shim installs with no dependencies
The @ada-cx/messaging-embed npm package now has no dependencies. Installing it no longer installs @ada-cx/messaging-sdk, and its TypeScript types ship inside the package.
Sites whose security review allows no Ada loader in their dependency tree can install the shim on its own. The shim’s behavior does not change.
See Iframe-only embed for setup.
Dashboard sign-ins now appear in the Audit log
The Audit log now records when a team member signs in to the dashboard, fails to sign in, or signs out. Security and compliance reviews can use these entries to show who accessed your AI Agent and when.
Each entry shows the team member, the sign-in method, such as Password, SSO, or Dialpad, and the interface. A failed sign-in is recorded only when the email belongs to a team member. Only Owners and Administrators see Sign-in entries on the Audit log page, in its filters and in the CSV export. Entries start on November 4, 2026. Earlier sign-ins are not recorded.
The entries also appear in the CSV export, the Audit log API, and the v1.audit_log.emitted webhook.
Learn more about the Audit log.