For admins

MCP is controlled per workspace. It is off by default for members: they can't connect an AI assistant until an account owner or super admin turns it on. The account owner and super admins can always connect.

1. Go to Settings → Developer → MCP.
2. Turn on Allow AI assistants (MCP) to connect to this workspace.

Only the account owner or a super admin can change this setting. Other members who can open Developer settings see it read-only.

The same page shows the MCP Server URL with a copy button, so you can share it with your team.

• Members can no longer connect AI assistants to the workspace, and their existing MCP connections stop working.
• The account owner and super admins can still connect, and their connections keep working. To cut off an admin's assistant, revoke it in Settings → Developer → Connected apps.
• Members who try to connect see: "AI assistants are turned off for this workspace. Ask your account owner or a super admin to enable them in Settings → Developer → MCP."
• API keys, and OAuth apps reviewed by iClosed that call the REST API directly, keep working.

Turning MCP back on lets assistants connect again.

Each member can see the apps they have authorized in Settings → Developer → Connected apps. The list shows when each app was authorized and when it was last active.

• Revoke removes one connection. The app has to ask for access again.
• Revoke all removes every connection for that app.

To disconnect every member's assistant at once, turn MCP off. Admin connections have to be revoked one by one.

• With MCP on, any member can connect an assistant to the workspace. With MCP off, only the account owner and super admins can.
• The assistant acts as that member. It can only do what the member's iClosed role allows, whatever scopes it asks for. For example, users:read needs User management access. See Security for the role access each scope needs.

See Security and permissions for details.