> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.ada.cx/llms.txt.

# Tool permissions

Control which MCP tools connected assistants can use from **Config > PLATFORM > MCP server**. These settings apply across MCP clients.

![The MCP server page showing Global settings with All tools selected and the list of read-only tools](/_fern-files/_img/0d9be775c61449895f577546305c2d3a46deb2aec8d4c0057f1366caa49212be.webp)

## Who can manage access

Only Owners can change tool permissions. Owners always follow global settings and cannot be restricted individually.

Members with the Admin role can use read and write tools. Members with the Agent or Read Only role can use read-only tools. An Owner can limit every non-Owner further.

Other members can view their tools under **Allowed MCP tools**. Contact an Owner to change access.

![The MCP server page for a member with the Agent role, showing the Allowed MCP tools list](/_fern-files/_img/394701e27b3b4cf147150e62086d7601c4d06fbb5501288332fcdad6f8755c46.webp)

When individual settings are enabled, only Owners can change another member's email address. This prevents moving a member's tool access to someone else.

## How permissions work

By default, **All tools** and **Global settings only** are selected. Existing connections keep their access until an Owner saves restrictions.

| Setting                            | Behavior                                                                                                   |
| ---------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| **All tools**                      | Allow current and future tools, subject to dashboard roles and individual settings.                        |
| **Selected tools**                 | Allow only the selected tools globally. New tools stay blocked. An empty selection blocks all tools.       |
| **Global settings only**           | Members follow global settings and their dashboard roles. API keys follow global settings.                 |
| **Global and individual settings** | Allow fewer tools for specific members or API keys. New API keys have no tools until an Owner allows them. |

Global settings apply to everyone, including Owners and API keys. Individual settings cannot allow tools blocked globally. Member settings also cannot exceed their [dashboard role](/mcp/introduction/authentication#permissions).

## Change global settings

1. Go to **Config > PLATFORM > MCP server**.
2. Under **Global settings**, choose **Selected tools**.
3. Review the descriptions under **Read-only tools** and **Write tools**.
4. In the **Allowed** column, select the check boxes of the tools to allow. Clear the check boxes of the tools to block.
5. Click **Save** in the bottom save bar.
6. Review the impact, then click **Save** in the confirmation.

![The MCP server page showing Selected tools with 19 of 21 tools allowed and the Get Conversation and Get Conversations check boxes cleared](/_fern-files/_img/eaef3c13b0139570d1fd8500529a9e93f0a0c29fb70d882bcaf4cd20bc498c0b.webp)

To allow current and future tools globally, choose **All tools** and save. The tool list is read-only in this mode.

> **Warning**
>
> Global restrictions apply to Owners and existing integrations too. If you clear every check box, the page shows "Saving will block all MCP tools for everyone, including Owners and API-key integrations." Blocking every tool stops all MCP tool calls. Dashboard access remains available to change the settings.

## Enable individual settings

1. Under **Individual settings**, choose **Global and individual settings**.
2. Open **Team members** or **API keys**.
3. Click **Edit settings** beside a member or key.
4. Clear the check boxes of the tools that should not be allowed.
5. Review the **Tools allowed** counts.
6. Click **Save**. Confirm if prompted.

![The Individual settings section of the MCP server page showing the Team members tab with each member's dashboard role and allowed tool count](/_fern-files/_img/f954f6475f666a6d28f93db2ee7c1b1bc447338b85daf490e9a66fc22fdcc789.webp)

The page saves global, member, and key changes together. **Discard changes** removes all unsaved edits.

Enabling individual settings for the first time preserves access for existing members and dashboard API keys. New members start with no tools unless an Owner configures a starting selection. Previously saved restrictions apply again when individual settings are re-enabled.

## Choose tools for new members

1. Open **Team members** in **Individual settings**.
2. Click **Edit default tools** beside the search field.
3. Choose **No tools** or **Selected tools**.
4. Select the check boxes of any starting tools, then click **Apply changes**.
5. Click **Save** on the page. Confirm if prompted.

These defaults apply to members added after saving. Changing them does not affect existing members, even if they have not connected yet. Global settings and dashboard roles still limit access.

## Change access in bulk

1. Open **Team members** or **API keys**.
2. Search if needed, then select the check boxes of the members or keys to change. Changing the search clears the selection.
3. To include every match on all pages, click **Select all**. The button shows the number of matches, for example **Select all 4**.
4. Click **Edit selected**.
5. Choose **Block tools** or **Allow tools**. In the **Selected** column, select the check boxes of the tools to change.
6. Review the impact, then click **Apply changes**.
7. Click **Save** on the page. Confirm if prompted.

![The Block tools for 2 members dialog showing Block tools selected, two tools selected, and the number of members that will change](/_fern-files/_img/edf161a003aee04e48251154a6c40a07b3d0b0c9e0fb3fc819837ca4b2cf09f4.webp)

Other allowed tools stay the same. Edited members and keys do not get new tools automatically. Allowing a write tool does not give it to members with the Agent or Read Only role.

## Change or remove member access

1. Find the member in **Team members**.
2. Click **Edit settings**.
3. Select or clear the check boxes in the **Allowed** column.
4. Click **Save**. Confirm any reduction in access.

![The Save changes dialog warning that 1 member will have fewer allowed tools](/_fern-files/_img/2f0d8499964563bd61f6ba10c20f73d1bfd6039eba1d5eb3d61eb3cdbd425764.webp)

Only tools allowed by global settings and the member's role appear in the editor. To remove all MCP tool access, clear every check box and save.

Saved changes apply across the member's OAuth connections.

## Manage API key access

1. Open **API keys** in **Individual settings**.
2. Find the key by its name and masked identifier.
3. Click **Edit settings** and select the check boxes of its allowed tools.
4. Click **Save**. Confirm any reduction in access.

![The API keys tab of the MCP server page showing two keys with their masked identifiers and allowed tool counts](/_fern-files/_img/904af55c1d90f4c1e246adeef68125837a8f21697a227106a3335b03dc149088.webp)

Anyone with the key can use its allowed tools. The key does not inherit the creator's dashboard role or personal MCP restrictions. Share keys only with people and systems that should have that access.

Create and delete keys in **Config > PLATFORM > API keys**. Only active dashboard keys that support MCP appear in the permissions table. With individual settings enabled, new and replacement keys have no MCP tools until an Owner allows them. Other Ada APIs are unaffected.

Renaming a key keeps its permissions. To replace a key without interrupting an integration, create the replacement first. Allow its tools, update the integration, then revoke the old key.

To remove a key's MCP tool access, clear every check box and save. If the save reduces a key's tools, the confirmation also says "Integrations that use blocked tools may stop working."

## Use global settings only

1. Choose **Global settings only**.
2. Click **Save**.
3. Confirm that individual restrictions will no longer apply.

![The Save changes dialog warning that individual restrictions will no longer apply](/_fern-files/_img/81063d52226264defd61c50a6c57c590f1810da91476b9b09a5e74fb6839ee1e.webp)

Members return to global settings, limited by their dashboard roles. API keys return to global settings. Saved individual restrictions remain stored and apply again if individual settings are enabled.

## When changes take effect

Changes apply to the next tool request, including existing connections.

Tool permissions do not filter free text or detect prompt injection. Blocking conversation tools does not remove every source of end-user text. See [Data privacy](/mcp/introduction/data-privacy#limits-of-tool-permissions) for text that other tools can return.

To disconnect an assistant, see [Managing connections](/mcp/introduction/managing-connections). For missing tools or errors, see [Troubleshooting](/mcp/introduction/troubleshooting#tool-access-problems).