> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nasiko.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User → agent MCP access

> Which external tools and connectors an agent is allowed to call.

Agents reach external tools through the [MCP gateway](/mcp-hub/overview). This page covers per-agent connector and tool permissions — what an agent may *do* once running, independent of who can chat with it.

## Two layers, checked in order

1. **Reachability** — can the calling user reach the connector at all? They can if they own it, it's shared with them (by username — team/department sharing is `nasiko-ee` only, see below), or it's a platform-managed integration they've connected their own account to. A connector that fails this check is invisible — it doesn't appear in the tool list.
2. **Per-agent permission** — is the connector enabled for *this* agent, and is the specific tool allowed?

Layer 2 is only consulted if Layer 1 passed. Reachability is re-evaluated on every call, never cached past a permission change.

## No configuration means fully allowed

Per-agent permission is **default-allow**. Sharing a connector with someone makes it usable on every agent they run, immediately. A permission row exists only to *restrict*: disable a connector for one agent, or apply a rule to its tools.

| Stance  | Effect                                     |
| ------- | ------------------------------------------ |
| `allow` | Callable normally (the default)            |
| `ask`   | Blocked and reported as requiring approval |
| `block` | Rejected outright                          |

Rules are glob patterns against tool names:

```json theme={null}
{
  "enabled": true,
  "tool_rules": [
    { "pattern": "SEND_*", "stance": "block" },
    { "pattern": "READ_*", "stance": "allow" },
    { "pattern": "DELETE_*", "stance": "ask" }
  ]
}
```

The connector stays enabled, but every `SEND_` tool is blocked, reads are allowed, and deletes need approval.

## Configuring it

| Action                                            | Route                                                            |
| ------------------------------------------------- | ---------------------------------------------------------------- |
| View an agent's connector access                  | `GET /api/mcp/agents/{agent_id}/connectors`                      |
| Set one connector's rules for one agent           | `PUT /api/mcp/agents/{agent_id}/connectors/{connector_id}`       |
| Inspect a connector's tools and effective stances | `GET /api/mcp/agents/{agent_id}/connectors/{connector_id}/tools` |
| View or bulk-update every tool rule               | `GET` / `PUT /api/mcp/agents/{agent_id}/tools`                   |
| Reset to default-allow                            | `DELETE /api/mcp/agents/{agent_id}/permissions`                  |

Example body for the `PUT`:

```json theme={null}
{
  "enabled": true,
  "tool_rules": [
    { "pattern": "SEND_*", "stance": "block" }
  ]
}
```

Configuring requires the ability to manage the agent (owner or superuser), *or* reachability to a connector already attached to it. The narrower path lets someone with a shared connector adjust it without gaining other control over the agent.

## Sharing a connector with a team or department

<Warning>
  **Enterprise feature.** Team/department connector sharing (this whole section) is `nasiko-ee`
  only. The open-source edition's connector sharing (see [MCP connector-sharing
  routes](/mcp-hub/overview)) covers public, per-user, and per-agent shares — no teams or
  departments.
</Warning>

Owners share by username through the [MCP connector-sharing routes](/mcp-hub/overview). Team and department sharing is an admin operation:

```bash theme={null}
nasiko-ee access mcp share <connector-id> --team platform-eng --dept engineering
nasiko-ee access mcp unshare <connector-id> --team platform-eng
nasiko-ee access mcp consumers <connector-id>   # agents, users, teams using it
```

<Note>
  Revoking a share also deletes the grantee's stored credential for that connector. A later re-grant starts from a clean reconnect.
</Note>

## Related

* [MCP overview](/mcp-hub/overview) — connectors, connections, request flow
* [User → agent access](/onboarding/acl/user-agent)
* [Access control overview](/onboarding/acl/overview)