Enabling MCP
MCP is in preview — its tools, scopes and endpoints may change before general availability.
MCP is off by default for every account, and it is deny-by-default in two independent dimensions. Both have to be on before a connection works:
- The account switch — MCP must be turned on for the account as a whole.
- The per-user permission — each user's role must grant the MCP permission.
They're independent — both must be on, or the connection is refused.
| Dimension | Default | Who sets it |
|---|---|---|
| Account switch | Off | You, in the Admin Center under Account Security. |
| Role permission | Off | You, under User roles & privileges. |
Turning it on
In the Telebroad Admin Center (Account → Settings):
- Account Security → turn on "Enable MCP server for this account" → Save.
- User roles & privileges → grant the MCP permission to each role whose users should connect.
Changes apply on the next request — the per-user permission is re-checked on every call, so removing it (or switching the account off) blocks the next call even while a token is still valid.
API keys are gated differently
An API-key connection has no user behind
it, so only the account switch applies — there is no per-role check. On an
enabled account, any key carrying reports:read can reach MCP.
The control for a key, therefore, is the key itself: scope it narrowly, restrict its source IPs, and revoke it when done. The per-role permission only governs OAuth (per-person) connections.
What a refusal looks like
A blocked request returns a 403 naming the gate — "mcp is not enabled for this
account" or "this user is not permitted to use mcp." If the setting can't be read
at all, it fails closed: denied, not granted.