Create an MCP configuration

An MCP configuration is an access to teamspace in its own right: with its own address, its own set of tools and its own release. You create as many of them as you have use cases – a general access for everyone, an HR access for the HR department, a sales access for the sales team.

This article covers the first step: creating the access itself. Which tools go into it is covered in Select and tailor tools.

Where the MCP configurations live

Configuration → Interfaces → MCP configurations

The Interfaces category gathers everything that connects teamspace to the outside world – alongside the MCP configurations, the OAuth tiles that play a part in MCP also live here.

The Interfaces category in the system configuration as a tile overview: Custom exports, Interfaces, Synchronisation, MCP configurations, OAuth clients, OAuth authorisations (audit), Tenant client policies and OAuth server settings — The "Interfaces" category in the system configuration with the tiles for MCP configurations, OAuth clients and OAuth authorisations (audit)

The list shows all existing accesses with name, description, address, the Active flag and the Number of active tools – the last column is the most useful one in day-to-day work, because it tells you at a glance whether an access has stayed lean.

The MCP configurations tab with two accesses: Employee with the description For everyday tasks and 36 active tools, and below it HR with the description For HR tasks and 6 active tools. Both are marked active; the identifier part of the addresses is redacted. — The list of MCP configurations with address, Active flag and Number of active tools – the lean HR access next to the large everyday access

Creating an access

Open Configuration → Interfaces → MCP configurations.
Click the plus at the top right. The New MCP configuration dialog appears.

Fill in the fields:

Field	Required	Meaning
Name	yes	Appears to the user on the OAuth consent screen. Choose something meaningful like “Employee” or “Sales” – not “MCP2”.
Active	–	Controls whether the access responds. Set by default; removing it is the fastest kill switch.
Language	yes	The language in which the tools are described. It applies to the whole access, not per user.
Description	–	One sentence on what the access is for – e.g. “For everyday tasks”. Helps you tidy up later.
Authorised group or person	–	Who may use the access. Add more via the plus.

Save and close.

The New MCP configuration dialog with the mandatory Name field, the Active flag set, the mandatory Language selection, the Description field and the Authorised group or person field with a plus button; at the bottom the Save, Save and close and Cancel buttons — The "New MCP configuration" dialog with Name, Active flag, Language, Description and authorised group

The access now exists – but without tools it can do nothing. Continue with Select and tailor tools.

Handing the address to your users

On saving, each configuration is given an address of its own following this pattern:

https://<your-tenant>/mcp/<identifier>

The identifier is a long, random string and is different for every access. This address is all a user needs – they enter it in their client, log in via OAuth, done. See Connect teamspace to Claude.

The address is not a password. It may sit on the intranet or go out by email. Anyone without a release gets nowhere with it, and anyone with a release sees only what their permissions allow anyway – see Security and permissions with MCP.

Common problems

The user has the address but can’t get in. Their account is not released for this access. Add them or their group under Authorised group or person – the address alone is not enough.

The client connects but finds no tools. The access has no active tools yet. Open the Tools tab and add some – see Select and tailor tools. At the same time, check that the configuration’s Active flag is set.

Common questions & needs

You want to …	How to
An access for all employees	Create a configuration, enter the employee group as the authorised group and include only read tools.
An access for one department only	Under “Authorised group or person”, enter only that group.
Switch an access off quickly	Remove the Active flag. Takes effect immediately, including for already connected clients.
Know who has connected the access	`Configuration → Interfaces → OAuth authorisations (audit)`.
An access for an English-speaking team	Create a separate configuration with Language = English. The language applies per access, not per user.
Check whether an access has grown too large	The Number of active tools column in the list, then the token estimate in the details panel of the access.
Release several groups	In the “Authorised group or person” field, add more via the plus.

Notes

Several lean accesses rather than one for everything. This is not a question of tidiness but of speed – the reasoning is in How MCP works in teamspace.
The name is public. It appears on the OAuth consent screen that every user sees when connecting.
The release does not replace permissions. It decides who may use the access – not what they get to see through it.
Changes to the tools take effect immediately. Users don’t have to set up their connector again.

Select and tailor tools MCP & AI agents Configuration
Security and permissions with MCP MCP & AI agents Concept
Connect teamspace to Claude MCP & AI agents How-to
Topic: Permissions Permissions