What it does
The MCP endpoint lets any MCP-compatible assistant — Claude Desktop, Cursor, your own agent — call the same actions your team uses in the product. It is not a new kind of user: it acts as you, and never more than you.
Setup steps
1. Create an API key in your security settings. Give it only the permissions the assistant needs — the key can be narrower than your own access, never wider.
2. Open "Connect an AI client" in your AI settings. It shows your workspace's MCP address and a ready-to-paste client configuration.
3. Add that configuration to your client, with the key as a bearer token.
4. Ask the assistant what it can do. It sees the actions your key allows.
What keeps it safe
- Your permissions, narrowed. The key carries your own permissions, limited by the scope you gave it. Anything you cannot do, it cannot do.
- Nothing destructive. Actions that delete or cannot be undone are never available to an assistant, whatever the key allows. It is told to ask you to run those in the product, where you see a confirmation first.
- Every call recorded. Each action an assistant takes is recorded in the audit log against you, with a note that it came from an API key.
- Revocable at once. Revoking the key ends its access immediately, and so does leaving the workspace.
Running it locally
For a desktop client on the same machine as the server there is also a local connection over a pipe instead of the network. It offers exactly the same actions and limits.
Related
See the AI page for how the AI works across the product, and the API for calling the same actions from your own code.