Where MCP tokens are managed

MCP tokens let someone point an AI client at their own helpdesk work. They are not managed from the admin panel, and that is deliberate: a token is a personal credential, not a shared key you hand out.

Where a person creates one:

1. They open the team workspace and go to Settings.
2. In the MCP card they click Generate token and name it.
3. The token is shown once, and they copy it into their MCP client.
4. To retire one, they click Revoke on it and confirm. Any client still using it stops working.

There is no admin screen listing everyone’s tokens, and no way to generate one on someone’s behalf.

What you control is the role behind the token:

• MCP requires team workspace access. A role without Access Dev ticked can never use MCP at all, whatever token exists. The Client role has no path to it.
• An agent holds exactly the permissions of the user whose token it carries. It cannot read a project that person cannot read, or close a record they cannot close.
• Every write an agent makes is attributed to that user.

So the way to narrow what an agent can do is to narrow the person’s role in the role editor on the Dashboard, or to remove them from a project. Both take effect on the agent’s next call.