Tool permissions

Control which MCP tools connected assistants can use from Config > PLATFORM > MCP server. These settings apply across MCP clients.

Who can manage access

Only Owners can change tool permissions. Owners always follow global settings and cannot be restricted individually.

Members with the Admin role can use read and write tools. Members with the Agent or Read Only role can use read-only tools. An Owner can limit every non-Owner further.

Other members can view their tools under Allowed MCP tools. Contact an Owner to change access.

When individual settings are enabled, only Owners can change another member’s email address. This prevents moving a member’s tool access to someone else.

How permissions work

By default, All tools and Global settings only are selected. Existing connections keep their access until an Owner saves restrictions.

Global settings apply to everyone, including Owners and API keys. Individual settings cannot allow tools blocked globally. Member settings also cannot exceed their dashboard role.

Change global settings

1. Go to Config > PLATFORM > MCP server.
2. Under Global settings, choose Selected tools.
3. Review the descriptions under Read-only tools and Write tools.
4. In the Allowed column, select the check boxes of the tools to allow. Clear the check boxes of the tools to block.
5. Click Save in the bottom save bar.
6. Review the impact, then click Save in the confirmation.

To allow current and future tools globally, choose All tools and save. The tool list is read-only in this mode.

Enable individual settings

1. Under Individual settings, choose Global and individual settings.
2. Open Team members or API keys.
3. Click Edit settings beside a member or key.
4. Clear the check boxes of the tools that should not be allowed.
5. Review the Tools allowed counts.
6. Click Save. Confirm if prompted.

The page saves global, member, and key changes together. Discard changes removes all unsaved edits.

Enabling individual settings for the first time preserves access for existing members and dashboard API keys. New members start with no tools unless an Owner configures a starting selection. Previously saved restrictions apply again when individual settings are re-enabled.

Choose tools for new members

1. Open Team members in Individual settings.
2. Click Edit default tools beside the search field.
3. Choose No tools or Selected tools.
4. Select the check boxes of any starting tools, then click Apply changes.
5. Click Save on the page. Confirm if prompted.

These defaults apply to members added after saving. Changing them does not affect existing members, even if they have not connected yet. Global settings and dashboard roles still limit access.

Change access in bulk

1. Open Team members or API keys.
2. Search if needed, then select the check boxes of the members or keys to change. Changing the search clears the selection.
3. To include every match on all pages, click Select all. The button shows the number of matches, for example Select all 4.
4. Click Edit selected.
5. Choose Block tools or Allow tools. In the Selected column, select the check boxes of the tools to change.
6. Review the impact, then click Apply changes.
7. Click Save on the page. Confirm if prompted.

Other allowed tools stay the same. Edited members and keys do not get new tools automatically. Allowing a write tool does not give it to members with the Agent or Read Only role.

Change or remove member access

1. Find the member in Team members.
2. Click Edit settings.
3. Select or clear the check boxes in the Allowed column.
4. Click Save. Confirm any reduction in access.

Only tools allowed by global settings and the member’s role appear in the editor. To remove all MCP tool access, clear every check box and save.

Saved changes apply across the member’s OAuth connections.

Manage API key access

1. Open API keys in Individual settings.
2. Find the key by its name and masked identifier.
3. Click Edit settings and select the check boxes of its allowed tools.
4. Click Save. Confirm any reduction in access.

Anyone with the key can use its allowed tools. The key does not inherit the creator’s dashboard role or personal MCP restrictions. Share keys only with people and systems that should have that access.

Create and delete keys in Config > PLATFORM > API keys. Only active dashboard keys that support MCP appear in the permissions table. With individual settings enabled, new and replacement keys have no MCP tools until an Owner allows them. Other Ada APIs are unaffected.

Renaming a key keeps its permissions. To replace a key without interrupting an integration, create the replacement first. Allow its tools, update the integration, then revoke the old key.

To remove a key’s MCP tool access, clear every check box and save. If the save reduces a key’s tools, the confirmation also says “Integrations that use blocked tools may stop working.”

Use global settings only

1. Choose Global settings only.
2. Click Save.
3. Confirm that individual restrictions will no longer apply.

Members return to global settings, limited by their dashboard roles. API keys return to global settings. Saved individual restrictions remain stored and apply again if individual settings are enabled.

When changes take effect

Changes apply to the next tool request, including existing connections.

Tool permissions do not filter free text or detect prompt injection. Blocking conversation tools does not remove every source of end-user text. See Data privacy for text that other tools can return.

To disconnect an assistant, see Managing connections. For missing tools or errors, see Troubleshooting.