{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/mcp/mcp.sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"For admins"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"for-admins","__idx":0},"children":["For admins"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["MCP is controlled per workspace. It is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["off by default for members"]},": they can't connect an AI assistant until an account owner or super admin turns it on. The account owner and super admins can always connect."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"turn-mcp-on-or-off","__idx":1},"children":["Turn MCP on or off"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Developer → MCP"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Turn on ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Allow AI assistants (MCP) to connect to this workspace"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Only the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["account owner"]}," or a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["super admin"]}," can change this setting. Other members who can open Developer settings see it read-only."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The same page shows the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["MCP Server URL"]}," with a copy button, so you can share it with your team."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"what-turning-it-off-does","__idx":2},"children":["What turning it off does"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Members can no longer connect AI assistants to the workspace, and their existing MCP connections stop working."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The account owner and super admins can still connect, and their connections keep working. To cut off an admin's assistant, revoke it in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Developer → Connected apps"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Members who try to connect see: \"AI assistants are turned off for this workspace. Ask your account owner or a super admin to enable them in Settings → Developer → MCP.\""]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["API keys, and OAuth apps reviewed by iClosed that call the REST API directly, keep working."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Turning MCP back on lets assistants connect again."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"see-and-revoke-connections","__idx":3},"children":["See and revoke connections"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each member can see the apps they have authorized in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Developer → Connected apps"]},". The list shows when each app was authorized and when it was last active."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Revoke"]}," removes one connection. The app has to ask for access again."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Revoke all"]}," removes every connection for that app."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To disconnect every member's assistant at once, turn MCP off. Admin connections have to be revoked one by one."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"who-can-connect-and-what-they-can-do","__idx":4},"children":["Who can connect, and what they can do"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["With MCP on, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["any member"]}," can connect an assistant to the workspace. With MCP off, only the account owner and super admins can."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The assistant acts as that member. It can only do what the member's iClosed role allows, whatever scopes it asks for. For example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["users:read"]}," needs User management access. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/mcp/security#scopes"},"children":["Security"]}," for the role access each scope needs."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/mcp/security"},"children":["Security and permissions"]}," for details."]}]},"headings":[{"value":"For admins","id":"for-admins","depth":1},{"value":"Turn MCP on or off","id":"turn-mcp-on-or-off","depth":2},{"value":"What turning it off does","id":"what-turning-it-off-does","depth":3},{"value":"See and revoke connections","id":"see-and-revoke-connections","depth":2},{"value":"Who can connect, and what they can do","id":"who-can-connect-and-what-they-can-do","depth":2}],"frontmatter":{"sidebar":{"path":"./mcp.sidebars.yaml"},"seo":{"title":"For admins"}},"lastModified":"2026-10-07T07:39:18.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/mcp/admins","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}