# MCP (/docs/reference/roles-permissions/mcp)



MCP servers belong to a tenant, not to individual users. There are no per-server owner, editor or viewer sharing grants. Tenant permissions govern server registration and management; current tenant members can discover and use their tenant's servers.

Credentials are personal. Linking a credential does not expose it to other tenant members, and permission to use a server does not replace authentication required by the external service.

## Permissions [#permissions]

This family contains **9 permissions**. “Baseline member” means every current tenant member already has the operation permission, including members with any system role. It does not bypass the resource checks described above. “Custom role” means the identifier can be selected when defining a custom role.

<Catalogue>
  <details className="catalogue-entry">
    <summary>
      ### mcp.credential.link [#mcpcredentiallink]

      <span className="catalogue-description">
        Link personal credentials to an MCP server, including API-key or OAuth authorization flows.
      </span>
    </summary>

    <div className="catalogue-content">
      Link personal credentials to an MCP server, including API-key or OAuth authorization flows.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### mcp.credential.status [#mcpcredentialstatus]

      <span className="catalogue-description">
        Represents baseline access to the caller's MCP credential-link status.
      </span>
    </summary>

    <div className="catalogue-content">
      Represents baseline access to the caller's MCP credential-link status. It does not expose another user's credentials.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | No. Personal credential status is available through baseline tenant membership.              |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### mcp.credential.unlink [#mcpcredentialunlink]

      <span className="catalogue-description">
        Remove the caller's stored credential link for an MCP server.
      </span>
    </summary>

    <div className="catalogue-content">
      Remove the caller's stored credential link for an MCP server.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### mcp.server.create [#mcpservercreate]

      <span className="catalogue-description">
        Register an MCP server for the selected tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      Register an MCP server for the selected tenant.

      | Property     | Value                                                                                                                                          |
      | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator)                                                    |
      | Custom role  | Yes                                                                                                                                            |
      | Also implies | [mcp.server.list](/docs/reference/roles-permissions/mcp#mcpserverlist), [mcp.server.read](/docs/reference/roles-permissions/mcp#mcpserverread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### mcp.server.delete [#mcpserverdelete]

      <span className="catalogue-description">
        Remove an MCP server registration from the tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      Remove an MCP server registration from the tenant.

      | Property     | Value                                                                                                                                                                                                                      |
      | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                                                                                            |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator)                                                                                                                                |
      | Custom role  | Yes                                                                                                                                                                                                                        |
      | Also implies | [mcp.server.list](/docs/reference/roles-permissions/mcp#mcpserverlist), [mcp.server.read](/docs/reference/roles-permissions/mcp#mcpserverread), [mcp.server.update](/docs/reference/roles-permissions/mcp#mcpserverupdate) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### mcp.server.list [#mcpserverlist]

      <span className="catalogue-description">
        List MCP servers registered in the selected tenant.
      </span>
    </summary>

    <div className="catalogue-content">
      List MCP servers registered in the selected tenant.

      | Property     | Value                                                                                        |
      | ------------ | -------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                              |
      | Granted by   | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role  | Yes                                                                                          |
      | Also implies | [mcp.server.read](/docs/reference/roles-permissions/mcp#mcpserverread)                       |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### mcp.server.read [#mcpserverread]

      <span className="catalogue-description">
        Inspect an MCP server registration and its configuration.
      </span>
    </summary>

    <div className="catalogue-content">
      Inspect an MCP server registration and its configuration.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### mcp.server.update [#mcpserverupdate]

      <span className="catalogue-description">
        Change a tenant MCP server's configuration.
      </span>
    </summary>

    <div className="catalogue-content">
      Change a tenant MCP server's configuration.

      | Property     | Value                                                                                                                                          |
      | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
      | Scope        | Selected tenant                                                                                                                                |
      | Granted by   | [Tenant administrator](/docs/reference/roles-permissions/system-roles#tenant-administrator)                                                    |
      | Custom role  | Yes                                                                                                                                            |
      | Also implies | [mcp.server.list](/docs/reference/roles-permissions/mcp#mcpserverlist), [mcp.server.read](/docs/reference/roles-permissions/mcp#mcpserverread) |
    </div>
  </details>

  <details className="catalogue-entry">
    <summary>
      ### mcp.server.use [#mcpserveruse]

      <span className="catalogue-description">
        Use a tenant MCP server, including discovering its available tools.
      </span>
    </summary>

    <div className="catalogue-content">
      Use a tenant MCP server, including discovering its available tools. A server can additionally require the caller's external-service credentials.

      | Property    | Value                                                                                        |
      | ----------- | -------------------------------------------------------------------------------------------- |
      | Scope       | Selected tenant                                                                              |
      | Granted by  | [Baseline member](/docs/reference/roles-permissions/system-roles#baseline-tenant-membership) |
      | Custom role | Yes                                                                                          |
    </div>
  </details>
</Catalogue>

## Related pages [#related-pages]

* [Roles and permissions catalogue](/docs/reference/roles-permissions)
* [System roles and baseline access](/docs/reference/roles-permissions/system-roles)