Docs / API and agents
Agent access page
Where a person finds the MCP address, the tools their assistant gets, and what agents did for them, and what the page can and cannot show about tokens.
/settings/agent-access (API GET /v1/agent-access) is for anyone who may use MCP: members of supplier and customer organizations, and staff. It shows the MCP address with a copy button, how to connect Claude, Claude Code, ChatGPT and Cursor, the tools this person's assistant gets (their role intersected with the agent ceiling; the list differs per role), and the person's own recent agent activity, each row with the agent that did it (who and what, never what was seen).
People who hold audit.view also get Agent activity in your organization: every agent event of the organization, each shown as "by agent X on behalf of Name". Credit references have no account and get a 403, as does anyone whose role lacks mcp.use (staff.mcp.use for staff).
There is no list of tokens and no revoke button. Tokens are issued and held by WorkOS AuthKit, and its MCP documentation describes no API to list or revoke a person's granted clients. Access ends through what the server checks on every call: the person's role and permissions, membership, sign-out everywhere, a suspended organization, and the five minute token lifetime. To drop one assistant, remove the connector inside that assistant.