Skip to main content

Agent Allowlisting

What It Does​

If you only ever use your one main assistant, you don't need this page — every connection you install is available to it automatically. Agent allowlisting only matters once you start creating additional agents (for example, a dedicated support agent or a sales assistant): each new agent starts with no access to any connection, and you choose which ones it's allowed to use.

Think of it like handing out keys individually — your main assistant holds a master set, but everyone else only gets the keys you actually give them.

Why It Matters​

Not every agent should be able to touch every connected app. A customer-facing support agent probably shouldn't have access to your accounting connection, even if your main assistant does. Allowlisting keeps that separation explicit instead of accidental.

How to Set It Up​

  1. Open the agent you want to configure and go to its settings.
  2. Find the Allowed MCPs section.
  3. Tick the connections this agent should be able to use. Anything left unticked stays off-limits to that agent.

If no connections are installed yet, this section will tell you to install one from the catalog first.

Scenario

A retail shop's main assistant is connected to both Xero (accounting) and Lightspeed (point-of-sale). They create a second agent, "Front Desk," to handle customer messages. In Front Desk's settings, they tick Lightspeed but leave Xero unticked — Front Desk can look up sales and stock, but has no way to touch the accounting data.

Default Behavior​

  • Your main agent is unrestricted — it automatically has access to every installed, connected MCP, and the Allowed MCPs section doesn't apply to it.
  • Every other agent starts with nothing allowed. You must explicitly tick each connection you want it to use.

If This Isn't Working as Expected​

  1. If an agent says it can't do something you'd expect it to, check its Allowed MCPs list first — this is the most common reason.
  2. Confirm the connection itself is actually connected (see Installing a Server) — an unconnected app won't show up as usable by any agent, including the main one.