> ## Documentation Index
> Fetch the complete documentation index at: https://docs.marketer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP connect

> Authorize compatible agents with OAuth, explicit scopes, workspace grants, role caps, and MCP-seat checks.

**MCP connect** is a personal, account-spanning setting. It lists the external agents you authorized and the workspaces each session may reach.

It is not an API-key minting page. Current product setup uses browser OAuth, and each teammate authorizes their own connection.

## The four access boundaries

An MCP request must pass all four:

1. **Your workspace membership** — you must still be able to reach the workspace.
2. **MCP seat** — the member must have an active seat for that workspace.
3. **Connection grant** — the OAuth session must include that workspace.
4. **Scope and workspace policy** — the requested tool must fit the granted scope, effective role, provider access, guardrails, and approvals.

Removing any boundary stops or narrows access without granting more authority elsewhere.

## Scope tiers

| Scope     | Customer purpose                              | Role boundary                                           |
| --------- | --------------------------------------------- | ------------------------------------------------------- |
| `read`    | Inspect workspace context and data            | Available to a valid read-only connection               |
| `propose` | Prepare recommendations or changes for review | A Member or broader workspace role is required          |
| `mutate`  | Perform an allowed change                     | Owner or Admin role is required for full mutation scope |

Marketer caps a connection to the most restrictive effective role across all granted workspaces. If any selected workspace is Viewer-only, the connection remains read-only across that combined grant.

<Warning>
  A `mutate` scope is not blanket permission. Provider access, guardrails, dry-run or confirmation requirements, approvals, and the tool's own checks continue to apply.
</Warning>

## Connect to Claude

Open **Settings** → **MCP connect**. Under **Connect to Claude**, choose the visible setup tab.

### Claude Code

1. Copy the displayed `claude mcp add --transport http marketer …` command.
2. Run it in your terminal.
3. Complete the browser OAuth authorization.
4. Review scopes and choose only the required workspaces.

### Claude Desktop or Cowork

1. In Claude Desktop, open **Settings → Integrations → Add**.
2. Copy and paste the MCP server URL shown in Marketer.
3. Complete OAuth.

The same integration is used for Claude Cowork.

### claude.ai

1. Open **claude.ai → Settings → Connectors → Add Custom Connector**.
2. Paste the MCP URL shown in Marketer.
3. Complete OAuth and workspace selection.

Team admins can manage organization-wide connector availability in Claude, but each Marketer connection remains attributable to the authorizing identity and bounded by Marketer access.

## Verify Connected agents

Under **Connected agents**, each session shows:

* client name;
* granted scope names;
* **Last used** or the connected time;
* granted workspace chips; and
* **Disconnect**.

Select the workspace control to edit that session's reach. A workspace without an active MCP seat cannot become usable merely by appearing in your ordinary workspace list.

### Safe first test

1. Grant one test workspace.
2. Start with `read` only.
3. Ask for a small result with a named account and completed date range.
4. Confirm an ungranted workspace is not reachable.
5. Add proposal or mutation use only after scope and workspace boundaries are correct.

## Change workspace grants

Editing a connection's workspace list does not require reconnecting the client.

* Adding a workspace requires your membership and seat there.
* Removing a workspace stops that OAuth session from reaching it.
* If your role becomes more restrictive, effective scopes are capped accordingly.
* If a seat is removed, the connection becomes unusable for that workspace even if the old chip remains visible until the page refreshes.

## Disconnect or rotate

Select **Disconnect** to revoke one connected-agent session. Use it for an unrecognized, obsolete, or compromised client.

Eligible account Owners and Admins also see **Account → MCP**, which summarizes sessions reaching that account. It can converge account connections to read-only or read-write subject to role caps.

The account page can regenerate credentials for existing sessions. Regeneration invalidates the old tokens and shows new access and refresh tokens once.

<Warning>
  Copy regenerated credentials directly into the intended client. Do not place them in chat, Slack, documentation, or screenshots. A session that failed to rotate keeps its existing credentials and must be retried separately.
</Warning>

## Seats and billing

MCP seats are managed in **Settings** → **Members**.

* The account Owner's seat is implicit.
* Teammate seats are per member and workspace.
* Only the account Owner can make paid seat changes.
* Account Admins can manage membership but not paid MCP seats.
* A seat cannot be granted before workspace access.
* Seat removal revokes that workspace's MCP entitlement; the confirmation explains applicable billing or credit.

See [Members and roles](/workspace-admin/members-and-roles).

## Recovery matrix

| Symptom                                   | Check                                                               |
| ----------------------------------------- | ------------------------------------------------------------------- |
| Browser authorization does not open       | Copy the current command or URL from Marketer and retry             |
| Workspace is absent during authorization  | Your membership and selected-workspace grant                        |
| Workspace appears but tools cannot use it | MCP seat and the session's workspace grant                          |
| Tool is missing                           | OAuth scopes, effective role cap, and required provider integration |
| Write request stays read-only             | Most restrictive role across granted workspaces                     |
| Connection is unfamiliar                  | Select **Disconnect**, then review account sessions and membership  |
| Rotated client stops working              | Replace both credentials shown in **New credentials**               |
| One rotation failed                       | Keep its current credentials and regenerate that session again      |

## Next step

Review [Guardrails and autonomy](/workspace-admin/guardrails-and-autonomy), then prove a one-workspace read-only session before widening scope or reach.


## Related topics

- [Members and roles](/workspace-admin/members-and-roles.md)
- [Workspace and admin](/workspace-admin/overview.md)
- [Workspace switching](/workspace-admin/workspace-switching.md)
- [Next steps](/get-started/next-steps.md)
- [Security and troubleshooting](/workspace-admin/security-and-troubleshooting.md)