From 97c8cd2a9c0cdfe8a2df344e38dc2c37b6c762db Mon Sep 17 00:00:00 2001 From: Paul Querna Date: Fri, 11 Sep 2026 20:47:31 +0000 Subject: [PATCH 1/3] Update MCP registration terminology to sources Co-authored-by: c1-squire-dev[bot] --- docs.json | 2 +- product/admin/aiam-overview.mdx | 30 +++++----- product/admin/audit-ai-tool-usage.mdx | 6 +- product/admin/code-mode.mdx | 6 +- product/admin/enable-ai-access-management.mdx | 26 ++++---- product/admin/mcp-resources.mdx | 18 +++--- product/admin/mcp-server/apollo.mdx | 26 ++++---- product/admin/mcp-server/auth0.mdx | 26 ++++---- product/admin/mcp-server/azure-devops.mdx | 34 +++++------ product/admin/mcp-server/bitbucket.mdx | 40 ++++++------- product/admin/mcp-server/box.mdx | 26 ++++---- product/admin/mcp-server/buildkite.mdx | 24 ++++---- product/admin/mcp-server/confluence.mdx | 26 ++++---- product/admin/mcp-server/crowdstrike.mdx | 26 ++++---- product/admin/mcp-server/datadog.mdx | 32 +++++----- product/admin/mcp-server/freshdesk.mdx | 26 ++++---- product/admin/mcp-server/github.mdx | 54 ++++++++--------- product/admin/mcp-server/gong.mdx | 24 ++++---- .../mcp-server/google-analytics-admin.mdx | 38 ++++++------ product/admin/mcp-server/google-analytics.mdx | 36 +++++------ .../mcp-server/google-cloud-project-setup.mdx | 46 +++++++------- product/admin/mcp-server/google-drive.mdx | 60 +++++++++---------- product/admin/mcp-server/granola.mdx | 38 ++++++------ product/admin/mcp-server/hubspot.mdx | 26 ++++---- .../mcp-server/jira-service-management.mdx | 26 ++++---- product/admin/mcp-server/jira.mdx | 26 ++++---- product/admin/mcp-server/linear.mdx | 56 ++++++++--------- product/admin/mcp-server/linkedin.mdx | 26 ++++---- product/admin/mcp-server/looker.mdx | 24 ++++---- product/admin/mcp-server/lucid.mdx | 48 +++++++-------- product/admin/mcp-server/mcp-bridge.mdx | 46 +++++++------- product/admin/mcp-server/metabase.mdx | 24 ++++---- product/admin/mcp-server/metronome.mdx | 24 ++++---- product/admin/mcp-server/monday.mdx | 38 ++++++------ product/admin/mcp-server/n8n.mdx | 48 +++++++-------- product/admin/mcp-server/notion.mdx | 42 ++++++------- product/admin/mcp-server/okta.mdx | 28 ++++----- product/admin/mcp-server/opsgenie.mdx | 24 ++++---- product/admin/mcp-server/pagerduty.mdx | 58 +++++++++--------- product/admin/mcp-server/pylon.mdx | 38 ++++++------ product/admin/mcp-server/ramp.mdx | 26 ++++---- product/admin/mcp-server/rapid7.mdx | 26 ++++---- product/admin/mcp-server/salesforce.mdx | 26 ++++---- product/admin/mcp-server/slack.mdx | 48 +++++++-------- product/admin/mcp-server/snowflake.mdx | 38 ++++++------ product/admin/mcp-server/statuspage.mdx | 24 ++++---- product/admin/mcp-server/tableau.mdx | 24 ++++---- product/admin/mcp-server/trello.mdx | 24 ++++---- product/admin/mcp-server/vectara.mdx | 32 +++++----- product/admin/mcp-server/wiz.mdx | 26 ++++---- product/admin/mcp-servers.mdx | 56 ++++++++--------- product/admin/tools-and-toolsets.mdx | 16 ++--- product/admin/user-roles.mdx | 12 ++-- product/cli/c1i-commands.mdx | 4 +- rap/mcp-gateway/INDEX.md | 2 +- rap/mcp-gateway/concepts-gateway.md | 20 +++---- rap/mcp-gateway/use-access-requests.md | 4 +- rap/mcp-gateway/use-async-executions.md | 2 +- rap/mcp-gateway/use-code-mode.md | 2 +- scripts/nav-paths.json | 4 +- 60 files changed, 844 insertions(+), 844 deletions(-) diff --git a/docs.json b/docs.json index 83b89c34..138daa4e 100644 --- a/docs.json +++ b/docs.json @@ -252,7 +252,7 @@ ] }, { - "group": "MCP servers", + "group": "MCP sources", "tag": "NEW", "pages": [ "product/admin/mcp-servers", diff --git a/product/admin/aiam-overview.mdx b/product/admin/aiam-overview.mdx index d96b36ea..385533cb 100644 --- a/product/admin/aiam-overview.mdx +++ b/product/admin/aiam-overview.mdx @@ -1,8 +1,8 @@ --- title: AI access management overview -description: How C1 governs AI tool and resource access — MCP servers, tools, toolsets, and AI clients. +description: How C1 governs AI tool and resource access — MCP sources, tools, toolsets, and AI clients. og:title: AI access management overview - C1 docs -og:description: How C1 governs AI tool and resource access — MCP servers, tools, toolsets, and AI clients. +og:description: How C1 governs AI tool and resource access — MCP sources, tools, toolsets, and AI clients. sidebarTitle: How AIAM works --- @@ -12,14 +12,14 @@ sidebarTitle: How AIAM works **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -AI Access Management (AIAM) extends C1's identity governance platform to the AI tool layer. It acts as a control plane between AI clients (Claude Desktop, Cursor, ChatGPT, Copilot, and other MCP-compatible clients) and the downstream MCP servers those clients connect to. +AI Access Management (AIAM) extends C1's identity governance platform to the AI tool layer. It acts as a control plane between AI clients (Claude Desktop, Cursor, ChatGPT, Copilot, and other MCP-compatible clients) and the MCP sources your organization governs. -When AIAM is enabled, every tool call from an AI client is routed through C1's identity-aware proxy. The proxy authenticates the caller, checks the tool call against the user's granted access profile, enforces any configured policy constraints, forwards the call to the downstream MCP server, and writes an audit log entry with full identity context. +When AIAM is enabled, every tool call from an AI client is routed through C1's identity-aware proxy. The proxy authenticates the caller, checks the tool call against the user's granted access profile, enforces any configured policy constraints, forwards the call to the source's MCP server, and writes an audit log entry with full identity context. AIAM covers the following capabilities: -- Registering and configuring MCP servers (from the 3,000+ hosted catalog) -- Discovering and classifying the tools and resources each server exposes +- Adding and configuring MCP sources from the catalog or an external URL +- Discovering and classifying the tools and resources each source exposes - Governing tool access at a granular level — admins review, approve, or disable individual tools and control which tools each user and agent can call - Governing resource access at a granular level — admins review, approve, or disable each static resource and URI template; C1 checks its linked read entitlement on every read - Bundling approved tools into toolsets and binding them to access profiles @@ -35,23 +35,23 @@ C1's AI Connections feature has two sides. This page covers AI access management | Concept | Description | | :--- | :--- | -| **MCP server** | A downstream service that exposes one or more tools via the Model Context Protocol. C1 hosts a curated catalog. | -| **C1 MCP** | The proxy your AI clients connect to. It accepts connections from AI clients, routes requests to the appropriate downstream servers, and enforces authorization on every tool call. AI clients connect to one URL — C1 MCP — not to each downstream server directly. | -| **Tool** | A single capability exposed by an MCP server (for example, `github_create_issue` or `salesforce_query`). C1 discovers tools automatically when an MCP server is registered. | -| **MCP resource** | A static resource or URI template exposed by an MCP server. C1 discovers it automatically. C1 checks its approval state and linked, resource-specific read entitlement on every read. Resources are not toolsets or catalog items. | -| **Toolset** | A named bundle of approved tools. Two kinds: C1-maintained per connector ("All approved tools" and "Read tools", suffixed with the server name) and custom (admin-curated). | +| **MCP source** | An upstream MCP endpoint or integration from which C1 discovers and governs tools. A Catalog MCP source comes from C1's available catalog; an External MCP source uses a customer- or vendor-provided endpoint. | +| **C1 MCP** | The proxy your AI clients connect to. It accepts connections from AI clients, routes requests to the appropriate MCP sources, and enforces authorization on every tool call. AI clients connect to one URL — C1 MCP — not to each upstream MCP server directly. | +| **Tool** | A single capability exposed by an MCP source (for example, `github_create_issue` or `salesforce_query`). C1 discovers tools automatically when a source is added. | +| **MCP resource** | A static resource or URI template exposed by an MCP source. C1 discovers it automatically. C1 checks its approval state and linked, resource-specific read entitlement on every read. Resources are not toolsets or catalog items. | +| **Toolset** | A named bundle of approved tools. Two kinds: C1-maintained per source ("All approved tools" and "Read tools", suffixed with the source name) and custom (admin-curated). | | **Access profile** | The same mechanism C1 already uses for traditional app access. A toolset is bound to an access profile, which carries the approval policy, expiry, and approvers. | | **AI client** | A specific registered AI client instance (for example, "Jess's Claude Desktop" or "the team's shared Cursor agent"). Registered via Dynamic Client Registration (DCR) or Client ID Metadata Document (CIMD). | | **AI connection** | The authenticated link between a user's AI client and C1. When a user connects an AI client to C1, C1 creates an AI connection record that ties the client instance to the user's identity. Admins can view, manage, and revoke AI connections across the tenant. | -| **Auth mode** | How an MCP server authenticates downstream. Supported methods include bearer token, custom header, basic auth, and OAuth2 (client credentials, service mode, per-user passthrough, and JWT bearer). | +| **Auth mode** | How C1 authenticates to an MCP source. Supported methods include bearer token, custom header, basic auth, and OAuth2 (client credentials, service mode, per-user passthrough, and JWT bearer). | | **Client type** | A classification on each AI client: personal, shared, service, or ephemeral. Tenant-level policy controls which types are allowed. | ## How the pieces fit together A typical end-to-end flow: -1. **Admin registers an MCP server** in C1 (for example, the GitHub MCP server) and configures its auth mode. -2. **C1 discovers the tools and resources** the server exposes. Tools begin as Unset; resources begin as Pending. +1. **Admin adds an MCP source** in C1 (for example, the GitHub Catalog MCP source) and configures its auth mode. +2. **C1 discovers the tools and resources** the source exposes. Tools begin as Unset; resources begin as Pending. 3. **Admin reviews and approves tools**, then bundles approved tools into a toolset. 4. **Admin reviews and approves resources**. C1 links each approved resource to its resource-specific read entitlement; resources remain independent of toolsets. 5. **Admin binds the toolset to an access profile** with an approval policy. @@ -63,7 +63,7 @@ A typical end-to-end flow: ## Where to go from here - New to AIAM? Start with [Enable AI access management](/product/admin/enable-ai-access-management). -- Already enabled? Move on to [Set up an MCP server](/product/admin/mcp-servers). +- Already enabled? Move on to [Set up an MCP source](/product/admin/mcp-servers). - Setting up audit and compliance? See [Audit AI tool usage](/product/admin/audit-ai-tool-usage). - Ready to test your setup as an end user? See [Get started with AI tools](/product/how-to/ai-tools). - Need to approve a discovered resource or manage its access? See [Govern MCP resources](/product/admin/mcp-resources). diff --git a/product/admin/audit-ai-tool-usage.mdx b/product/admin/audit-ai-tool-usage.mdx index ec426796..ca049c53 100644 --- a/product/admin/audit-ai-tool-usage.mdx +++ b/product/admin/audit-ai-tool-usage.mdx @@ -22,19 +22,19 @@ Each tool call produces one audit log entry with: | **Timestamp** | `2026-05-07T14:23:11Z` | | **End user** | The C1 user the AI client is bound to | | **AI client** | Client ID and display name | -| **MCP server** | Registered server name | +| **MCP source** | Source name | | **Tool** | Tool name (for example, `github_create_issue`) | | **Result** | Success / denied / error | | **Denial reason** | Populated when result = denied (for example, "tool not in user's access profile", "kill switch active", "client closed") | | **Latency** | Round-trip time for the call | -Each MCP resource read also produces an audit log entry. It includes the end user, AI client, MCP server, resource URI or URI template, result, denial reason when applicable, latency, and response byte count. C1 does not store resource content in the audit event. +Each MCP resource read also produces an audit log entry. It includes the end user, AI client, MCP source, resource URI or URI template, result, denial reason when applicable, latency, and response byte count. C1 does not store resource content in the audit event. In addition to tool call events, the following non-call events are also captured: - Access request submitted / approved / denied - Tool approved / disabled / classification changed -- MCP server registered / removed / auth changed +- MCP source added / removed / auth changed - AI client registered / state changed (active → hidden → closed → deleted) - Kill switch flipped (tenant, server, tool, or client level) - Tenant defaults changed diff --git a/product/admin/code-mode.mdx b/product/admin/code-mode.mdx index 69968000..c5f75be1 100644 --- a/product/admin/code-mode.mdx +++ b/product/admin/code-mode.mdx @@ -15,9 +15,9 @@ Read this page to understand what your users' AI agents are doing when they call ## How the gateway fits in -C1 is an MCP gateway. AI clients connect to one C1 MCP endpoint, and C1 sits in front of every MCP server and integration your organization has approved. Agents never connect to those servers directly. +C1 is an MCP gateway. AI clients connect to one C1 MCP endpoint, and C1 sits in front of every MCP source your organization has approved. Agents never connect to those upstream MCP servers directly. -On each call, C1 authenticates the human or workload behind the agent, applies per-tool governance, and routes the call to the right upstream server — a hosted server from the catalog, a vendor MCP server, or a private server reached over an [MCP bridge](/product/admin/mcp-server/mcp-bridge). One MCP connection, many governed systems behind it. +On each call, C1 authenticates the human or workload behind the agent, applies per-tool governance, and routes the call to the right MCP source — a Catalog MCP source, an External MCP source at a vendor-provided endpoint, or an External MCP source reached over an [MCP bridge](/product/admin/mcp-server/mcp-bridge). One MCP connection, many governed systems behind it. ## What code mode changes @@ -144,7 +144,7 @@ Executions are capped at 15 minutes total; the polling response reports elapsed ## Where to go from here -- Setting up the servers behind the gateway? See [Set up an MCP server](/product/admin/mcp-servers). +- Setting up the sources behind the gateway? See [Set up an MCP source](/product/admin/mcp-servers). - Governing which tools are callable? See [Govern tools and toolsets](/product/admin/tools-and-toolsets). - Constraining calls at runtime? See [Tool call hooks](/product/admin/tool-call-hooks). - Reviewing what agents actually called? See [Audit AI tool usage](/product/admin/audit-ai-tool-usage). diff --git a/product/admin/enable-ai-access-management.mdx b/product/admin/enable-ai-access-management.mdx index ca20301e..81bd1feb 100644 --- a/product/admin/enable-ai-access-management.mdx +++ b/product/admin/enable-ai-access-management.mdx @@ -1,8 +1,8 @@ --- title: Enable AI access management -description: Turn on AIAM for your tenant and configure tenant-wide defaults for MCP servers, tools, and AI clients. +description: Turn on AIAM for your tenant and configure tenant-wide defaults for MCP sources, tools, and AI clients. og:title: Enable AI access management - C1 docs -og:description: Turn on AIAM for your tenant and configure tenant-wide defaults for MCP servers, tools, and AI clients. +og:description: Turn on AIAM for your tenant and configure tenant-wide defaults for MCP sources, tools, and AI clients. --- {/* Editor Refresh: 2026-09-02 */} @@ -11,13 +11,13 @@ og:description: Turn on AIAM for your tenant and configure tenant-wide defaults **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -AIAM lets you govern which AI clients can call which tools on your behalf, and which end users are allowed to use them. Enabling AIAM for your tenant is a one-time task that requires the **Super Administrator** role. Configuring tenant defaults, registering MCP servers, governing tools, managing AI clients, and using kill switches can be performed by either a Super Administrator or a user with the [AI Governance Administrator](/product/admin/user-roles#ai-governance-administrator) role. +AIAM lets you govern which AI clients can call which tools on your behalf, and which end users are allowed to use them. Enabling AIAM for your tenant is a one-time task that requires the **Super Administrator** role. Configuring tenant defaults, adding MCP sources, governing tools, managing AI clients, and using kill switches can be performed by either a Super Administrator or a user with the [AI Governance Administrator](/product/admin/user-roles#ai-governance-administrator) role. -Individual MCP servers, tools, and clients can override most of these defaults later. Set the defaults to the safest configuration you're willing to live with as a fallback. +Individual MCP sources, tools, and clients can override most of these defaults later. Set the defaults to the safest configuration you're willing to live with as a fallback. ## Enable AIAM for your tenant -Enabling AIAM exposes the AIAM surfaces (MCP servers, tools, AI clients, AIAM audit log) to admins. It does **not** automatically grant any end user access to any tool — every tool still has to be approved, added to a toolset, and bound to an access profile before it becomes requestable. +Enabling AIAM exposes the AIAM surfaces (MCP sources, tools, AI clients, AIAM audit log) to admins. It does **not** automatically grant any end user access to any tool — every tool still has to be approved, added to a toolset, and bound to an access profile before it becomes requestable. @@ -37,7 +37,7 @@ Click **Save** to confirm. -Once enabled, **MCP servers**, **MCP clients**, and the **AIAM audit log** appear in the tenant. +Once enabled, **Sources**, **MCP clients**, and the **AIAM audit log** appear in the tenant. ## Configure tenant defaults @@ -76,7 +76,7 @@ Any in-flight client of a now-disallowed type continues to function until its ex ### Default tool classification -When C1 discovers a new tool on a registered MCP server, it assigns the tool this initial state. Until an admin reviews and approves the tool, it cannot be added to a toolset and end users cannot request it. +When C1 discovers a new tool from an MCP source, it assigns the tool this initial state. Until an admin reviews and approves the tool, it cannot be added to a toolset and end users cannot request it. - **State**: Pending Review / Unset (recommended — keeps every newly-discovered tool out of end-user reach until you've reviewed it) - **Classification**: Sensitive (default) @@ -85,7 +85,7 @@ To change the defaults: -In **AI > MCPs > Settings**, find **Default tool classification**. +In **AI > Sources > Settings**, find **Default tool classification**. Select the state and classification to apply to newly-discovered tools. @@ -134,7 +134,7 @@ Click **Save**. ### Emergency kill switch -The kill switch immediately revokes every AI client's access to every tool, across all MCP servers in your tenant. Use it when you suspect an active compromise — for example, a leaked client credential or an MCP server that's behaving unexpectedly. +The kill switch immediately revokes every AI client's access to every tool, across all MCP sources in your tenant. Use it when you suspect an active compromise — for example, a leaked client credential or an MCP server that's behaving unexpectedly. **What happens when you flip it:** @@ -152,13 +152,13 @@ Toggle **Disable MCP traffic**. -### Per-server kill switch +### Per-source kill switch -Each registered MCP server also has its own kill switch, independent of the tenant-wide one. Flipping it blocks all MCP requests for that connector only — other servers keep working. +Each MCP source also has its own kill switch, independent of the tenant-wide one. Flipping it blocks all MCP requests for that source only — other sources keep working. -Open the MCP server's configuration tab. +Open the MCP source's configuration tab. Toggle the kill switch. @@ -168,5 +168,5 @@ Click **Save**. -Combined with the per-tool kill switch ([Govern tools and toolsets](/product/admin/tools-and-toolsets)) and the per-client kill switch ([Manage AI clients](/product/admin/ai-clients)), C1 offers kill switches at four scopes: tenant, server, tool, and client. +Combined with the per-tool kill switch ([Govern tools and toolsets](/product/admin/tools-and-toolsets)) and the per-client kill switch ([Manage AI clients](/product/admin/ai-clients)), C1 offers kill switches at four scopes: tenant, source, tool, and client. diff --git a/product/admin/mcp-resources.mdx b/product/admin/mcp-resources.mdx index c4d6cf46..f1a44ecb 100644 --- a/product/admin/mcp-resources.mdx +++ b/product/admin/mcp-resources.mdx @@ -11,7 +11,7 @@ og:description: Review MCP resources and URI templates discovered by C1, approve **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -An MCP server can expose more than tools. It can also expose static resources, such as a named document, and URI templates, which resolve a resource from a URI supplied by the client. C1 discovers these items when it discovers the MCP server and governs them independently from tools. +An MCP server can expose more than tools. It can also expose static resources, such as a named document, and URI templates, which resolve a resource from a URI supplied by the client. C1 discovers these items through an MCP source and governs them independently from tools. This page describes how to review and manage discovered MCP resources. For tool governance, see [Govern tools and toolsets](/product/admin/tools-and-toolsets). @@ -22,7 +22,7 @@ Each approved MCP resource has its own read entitlement. A user can read a resou - The resource is **Approved**. - Its linked entitlement is active. - The user has a grant for that entitlement. -- The MCP server and tenant controls allow the request. +- The MCP source and tenant controls allow the request. A tool grant does not grant access to a resource. Resources are not added to toolsets or exposed as catalog items. C1 does not provide an end-user resource request flow. @@ -30,21 +30,21 @@ Resource content is returned only when the AI client explicitly reads the resour ## View discovered resources -To see the resources C1 discovered from a server, open the server's resource inventory. +To see the resources C1 discovered from an MCP source, open the source's resource inventory. -Go to **AI > MCPs**. +Go to **AI > Sources**. -Open a registered MCP server. +Open an MCP source. Click the **Resources** tab. -The table lists static resources and URI templates that C1 discovered from the server. It includes each item's name, kind, URI or template, MIME type, state, access status, and last-discovered time. +The table lists static resources and URI templates that C1 discovered from the source. It includes each item's name, kind, URI or template, MIME type, state, access status, and last-discovered time. Use the search field to find a name, description, URI, or template. Filter by kind or state when you need to focus on a subset of the inventory. Open a resource to view its complete URI or template, metadata, linked entitlement, grant count, and discovery history. @@ -63,14 +63,14 @@ To approve or disable a resource: -On the MCP server's **Resources** tab, open the resource's **...** (more actions) menu, or click the resource's name to open its details panel. +On the MCP source's **Resources** tab, open the resource's **...** (more actions) menu, or click the resource's name to open its details panel. Click **Approve** or **Disable**. -Only the lifecycle state is editable. C1 preserves the URI or URI template exactly as the MCP server advertised it. Changes to discovered metadata retain the resource's state. A changed URI or template is a new pending resource; the old resource is marked Removed. +Only the lifecycle state is editable. C1 preserves the URI or URI template exactly as the source's MCP server advertised it. Changes to discovered metadata retain the resource's state. A changed URI or template is a new pending resource; the old resource is marked Removed. ## Inspect resource access @@ -95,4 +95,4 @@ If an upstream server stops advertising a resource, C1 marks it **Removed**. If ## Audit resource reads -C1 logs each allowed and denied resource read. The audit record identifies the caller, MCP server, resource, result, reason for a denial when applicable, latency, and response size. It does not store resource content. For audit-log details and export options, see [Audit AI tool usage](/product/admin/audit-ai-tool-usage). +C1 logs each allowed and denied resource read. The audit record identifies the caller, MCP source, resource, result, reason for a denial when applicable, latency, and response size. It does not store resource content. For audit-log details and export options, see [Audit AI tool usage](/product/admin/audit-ai-tool-usage). diff --git a/product/admin/mcp-server/apollo.mdx b/product/admin/mcp-server/apollo.mdx index 89a0b42e..7b919bc8 100644 --- a/product/admin/mcp-server/apollo.mdx +++ b/product/admin/mcp-server/apollo.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Apollo MCP server -description: Create an Apollo API key and register the Apollo MCP server in C1 so AI clients can call governed Apollo tools. -og:title: Set up the Apollo MCP server -og:description: Create an Apollo API key and register the Apollo MCP server in C1 so AI clients can call governed Apollo tools. +title: Set up the Apollo MCP source +description: Create an Apollo API key and add Apollo as a Catalog MCP source in C1 so AI clients can call governed Apollo tools. +og:title: Set up the Apollo MCP source +og:description: Create an Apollo API key and add Apollo as a Catalog MCP source in C1 so AI clients can call governed Apollo tools. sidebarTitle: Apollo --- @@ -12,7 +12,7 @@ sidebarTitle: Apollo **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Apollo MCP server lets you govern access to Apollo — contacts, accounts, and other sales data — as tools your AI clients can call through C1. +The Apollo Catalog MCP source lets you govern access to Apollo — contacts, accounts, and other sales data — as tools your AI clients can call through C1. Apollo authenticates with an API key sent in a request header. A single key authenticates everyone, so all tool calls reach Apollo as one shared identity. Create the key from a dedicated service-account user so activity is attributable to C1 rather than a person. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Apollo on your users' - An Apollo account with permission to create API keys, which typically requires an admin role. -If you don't see **Apollo** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Apollo** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create an Apollo API key @@ -51,15 +51,15 @@ Limit the key to only the endpoints you need, then copy the key. Treat the key l Every user's tool calls use the one API key you provided, so Apollo sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared production setup, create the key from a dedicated service-account user so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Apollo MCP server in C1 +## Add the Apollo Catalog MCP source in C1 -With your API key ready, register the server and provide your credentials. +With your API key ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Apollo** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Apollo** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Custom header**, enter the header name `X-Api-Key`, and paste your API key as the value. @@ -71,9 +71,9 @@ Save your changes. C1 starts a sync that discovers the tools the Apollo server e ## Discover and govern tools -After you register the server, C1 runs tool discovery against Apollo. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Apollo. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Apollo tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -83,5 +83,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Apollo credentials -- **Rotate the API key** by creating a new key in Apollo and updating it on the server's authentication settings in C1, then revoking the old key. +- **Rotate the API key** by creating a new key in Apollo and updating it on the source's authentication settings in C1, then revoking the old key. - **Adjust access** by limiting the key's endpoints in Apollo. diff --git a/product/admin/mcp-server/auth0.mdx b/product/admin/mcp-server/auth0.mdx index 376cde5e..ef8b15ba 100644 --- a/product/admin/mcp-server/auth0.mdx +++ b/product/admin/mcp-server/auth0.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Auth0 MCP server -description: Create an Auth0 Management API token, then register the Auth0 MCP server in C1 and govern the tools your AI clients can call. -og:title: Set up the Auth0 MCP server -og:description: Create an Auth0 Management API token, then register the Auth0 MCP server in C1 and govern the tools your AI clients can call. +title: Set up the Auth0 MCP source +description: Create an Auth0 Management API token, then add Auth0 as a Catalog MCP source in C1 and govern the tools your AI clients can call. +og:title: Set up the Auth0 MCP source +og:description: Create an Auth0 Management API token, then add Auth0 as a Catalog MCP source in C1 and govern the tools your AI clients can call. sidebarTitle: Auth0 --- @@ -12,7 +12,7 @@ sidebarTitle: Auth0 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Auth0 MCP server lets you govern access to Auth0 — users, connections, applications, roles, and other tenant data managed through the Auth0 Management API — as tools your AI clients can call through C1. +The Auth0 Catalog MCP source lets you govern access to Auth0 — users, connections, applications, roles, and other tenant data managed through the Auth0 Management API — as tools your AI clients can call through C1. Auth0 authenticates with a Management API token. A single token authenticates every user, so all tool calls reach Auth0 as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Auth0 on your users' b - An Auth0 account with permission to create a machine-to-machine application authorized for the Auth0 Management API. -If you don't see **Auth0** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Auth0** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create an Auth0 Management API token @@ -53,15 +53,15 @@ For a shared production setup, use a dedicated machine-to-machine application so The Management API token authenticates every user as one shared Auth0 identity, so Auth0 sees a single identity for all tool calls. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, create the credential from a dedicated machine-to-machine application so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Auth0 MCP server in C1 +## Add the Auth0 Catalog MCP source in C1 -With your Management API token ready, register the server and provide your credentials. +With your Management API token ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Auth0** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Auth0** from the catalog. Enter your Auth0 tenant URL, such as `https://your-tenant.us.auth0.com`. @@ -76,9 +76,9 @@ Save your changes. C1 starts a sync that discovers the tools the Auth0 server ex ## Discover and govern tools -After you register the server, C1 runs tool discovery against Auth0. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Auth0. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Auth0 tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -88,5 +88,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Auth0 credentials -- **Rotate the Management API token** by rotating the client secret on the machine-to-machine application in the Auth0 Dashboard, then update the token on the server's authentication settings in C1. +- **Rotate the Management API token** by rotating the client secret on the machine-to-machine application in the Auth0 Dashboard, then update the token on the source's authentication settings in C1. - **Adjust access** by editing the Management API permissions granted to the application in Auth0. diff --git a/product/admin/mcp-server/azure-devops.mdx b/product/admin/mcp-server/azure-devops.mdx index 5c40ad91..352aabcd 100644 --- a/product/admin/mcp-server/azure-devops.mdx +++ b/product/admin/mcp-server/azure-devops.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Azure DevOps MCP server -description: Connect Azure DevOps to C1 with a personal access token or a Microsoft Entra token, then register the MCP server and govern its tools. -og:title: Set up the Azure DevOps MCP server -og:description: Connect Azure DevOps to C1 with a personal access token or a Microsoft Entra token, then register the MCP server and govern its tools. +title: Set up the Azure DevOps MCP source +description: Connect Azure DevOps to C1 with a personal access token or a Microsoft Entra token, then add the Catalog MCP source and govern its tools. +og:title: Set up the Azure DevOps MCP source +og:description: Connect Azure DevOps to C1 with a personal access token or a Microsoft Entra token, then add the Catalog MCP source and govern its tools. sidebarTitle: Azure DevOps --- @@ -12,11 +12,11 @@ sidebarTitle: Azure DevOps **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Azure DevOps MCP server lets you govern access to Azure DevOps — projects, Git repositories, pull requests, builds, pipelines, teams, and work item queries — as tools your AI clients can call through C1. +The Azure DevOps Catalog MCP source lets you govern access to Azure DevOps — projects, Git repositories, pull requests, builds, pipelines, teams, and work item queries — as tools your AI clients can call through C1. -Azure DevOps is organization-scoped: every API call is rooted at your organization URL. You provide your organization slug — the segment after `https://dev.azure.com/` in your organization URL (for example, `https://dev.azure.com/acme` becomes `acme`) — when you register the server. +Azure DevOps is organization-scoped: every API call is rooted at your organization URL. You provide your organization slug — the segment after `https://dev.azure.com/` in your organization URL (for example, `https://dev.azure.com/acme` becomes `acme`) — when you add the source. -Azure DevOps supports two ways to authenticate, and you choose one when you register the server: +Azure DevOps supports two ways to authenticate, and you choose one when you add the source: - **Personal access token**. A single token authenticates everyone, so all tool calls reach Azure DevOps as one shared identity. - **Microsoft Entra token**. A Microsoft Entra access token issued for the Azure DevOps resource authenticates everyone as one shared identity. @@ -37,7 +37,7 @@ The credentials you set up below are what C1 uses to call Azure DevOps on your u - For a Microsoft Entra token, permission to [register an application in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) and obtain a token for the Azure DevOps resource. -If you don't see **Azure DevOps** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Azure DevOps** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Use a personal access token @@ -68,13 +68,13 @@ Select **Create** and copy the token. Azure DevOps shows the token only once. For a shared production setup, create the token from a dedicated service account so activity is attributable to C1 rather than a person. -### Register the server with a token +### Add the source with a token -With your personal access token ready, register the server and provide your credentials. +With your personal access token ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Azure DevOps** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Azure DevOps** from the catalog. Enter your **organization** slug when prompted. @@ -105,13 +105,13 @@ Copy the access token. Treat it as a high-value credential. Microsoft Entra acce -### Register the server with a Microsoft Entra token +### Add the source with a Microsoft Entra token -With your Microsoft Entra access token ready, register the server and provide your credentials. +With your Microsoft Entra access token ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Azure DevOps** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Azure DevOps** from the catalog. Enter your **organization** slug when prompted. @@ -128,13 +128,13 @@ Save your changes. C1 starts a sync that discovers the tools the Azure DevOps se Both authentication methods are shared: every user's tool calls use the one credential you provided, so Azure DevOps sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated service account so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Azure DevOps. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Azure DevOps. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Azure DevOps tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/bitbucket.mdx b/product/admin/mcp-server/bitbucket.mdx index 3ef3dacd..9ea600db 100644 --- a/product/admin/mcp-server/bitbucket.mdx +++ b/product/admin/mcp-server/bitbucket.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Bitbucket MCP server -description: Connect Bitbucket to C1 with per-user OAuth, an app password, or an API token, then register the MCP server and govern its tools. -og:title: Set up the Bitbucket MCP server -og:description: Connect Bitbucket to C1 with per-user OAuth, an app password, or an API token, then register the MCP server and govern its tools. +title: Set up the Bitbucket MCP source +description: Connect Bitbucket to C1 with per-user OAuth, an app password, or an API token, then add the Catalog MCP source and govern its tools. +og:title: Set up the Bitbucket MCP source +og:description: Connect Bitbucket to C1 with per-user OAuth, an app password, or an API token, then add the Catalog MCP source and govern its tools. sidebarTitle: Bitbucket --- @@ -12,9 +12,9 @@ sidebarTitle: Bitbucket **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Bitbucket MCP server lets you govern access to Bitbucket Cloud — repositories, pull requests, issues, pipelines, projects, and workspace data — as tools your AI clients can call through C1. +The Bitbucket Catalog MCP source lets you govern access to Bitbucket Cloud — repositories, pull requests, issues, pipelines, projects, and workspace data — as tools your AI clients can call through C1. -Bitbucket supports three ways to authenticate, and you choose one when you register the server: +Bitbucket supports three ways to authenticate, and you choose one when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own Bitbucket account, so every tool call runs under that user's identity and permissions. - **App password**. A single app password authenticates everyone, so all tool calls reach Bitbucket as one shared identity. @@ -35,7 +35,7 @@ The credentials you set up below are what C1 uses to call Bitbucket on your user - For an app password or API token, a Bitbucket account whose access the credential should carry. -If you don't see **Bitbucket** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Bitbucket** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -64,13 +64,13 @@ Save the consumer, then open it to copy the **Key** (client ID) and **Secret** ( -### Register the server with OAuth +### Add the source with OAuth -With your OAuth consumer ready, register the server and provide its credentials. +With your OAuth consumer ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Bitbucket** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Bitbucket** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your consumer's **client ID** (key) and **client secret**. @@ -102,13 +102,13 @@ Create the app password and copy it. Bitbucket shows it only once. For a shared production setup, create the app password from a dedicated service account so activity is attributable to C1 rather than a person. -### Register the server with an app password +### Add the source with an app password -With your app password ready, register the server and provide its credentials. +With your app password ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Bitbucket** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Bitbucket** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Basic auth**. Enter your Bitbucket **username** and paste the **app password** as the password. @@ -137,13 +137,13 @@ Copy the generated token. Treat it as a high-value credential. For a shared production setup, create the API token from a dedicated service account so activity is attributable to C1 rather than a person. -### Register the server with an API token +### Add the source with an API token -With your API token ready, register the server and provide its credentials. +With your API token ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Bitbucket** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Bitbucket** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Custom header**. Set the header name to `Authorization` and the value to `Bearer ` followed by your API token (for example, `Bearer abc123`). @@ -160,13 +160,13 @@ How Bitbucket sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Bitbucket account, so tool calls run under that user's Bitbucket identity and inherit only the access they already have. Bitbucket attributes each action to the individual user. - **App password or API token.** Every user's tool calls use the one credential you provided, so Bitbucket sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Bitbucket. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Bitbucket. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Bitbucket tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -176,7 +176,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Bitbucket credentials -- **Rotate the OAuth client secret** by regenerating the secret on your Bitbucket OAuth consumer under **Workspace settings** > **OAuth consumers**, then update it on the server's authentication settings in C1. +- **Rotate the OAuth client secret** by regenerating the secret on your Bitbucket OAuth consumer under **Workspace settings** > **OAuth consumers**, then update it on the source's authentication settings in C1. - **Rotate an app password** by creating a new app password in Bitbucket and updating it in C1, then deleting the old one. - **Rotate an API token** by generating a new token and updating it in C1, then revoking the old one. - **Adjust access** by editing the consumer's permissions, the app password's permissions, or the token's scope in Bitbucket. diff --git a/product/admin/mcp-server/box.mdx b/product/admin/mcp-server/box.mdx index fa94222d..c9ff09af 100644 --- a/product/admin/mcp-server/box.mdx +++ b/product/admin/mcp-server/box.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Box MCP server -description: Connect Box to C1 with per-user OAuth or a shared OAuth2 service app, then register the Box MCP server and govern its tools. -og:title: Set up the Box MCP server -og:description: Connect Box to C1 with per-user OAuth or a shared OAuth2 service app, then register the Box MCP server and govern its tools. +title: Set up the Box MCP source +description: Connect Box to C1 with per-user OAuth or a shared OAuth2 service app, then add Box as a Catalog MCP source and govern its tools. +og:title: Set up the Box MCP source +og:description: Connect Box to C1 with per-user OAuth or a shared OAuth2 service app, then add Box as a Catalog MCP source and govern its tools. sidebarTitle: Box --- @@ -12,9 +12,9 @@ sidebarTitle: Box **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Box MCP server lets you govern access to Box — files, folders, users, groups, and other content data — as tools your AI clients can call through C1. +The Box Catalog MCP source lets you govern access to Box — files, folders, users, groups, and other content data — as tools your AI clients can call through C1. -Box authenticates with OAuth. You create a Box app, then choose how users connect when you register the server: +Box authenticates with OAuth. You create a Box app, then choose how users connect when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own Box account, so every tool call runs under that user's Box identity and permissions. - **OAuth2 service mode**. A single shared app authenticates everyone, so all tool calls reach Box as one shared identity. @@ -33,7 +33,7 @@ The credentials you set up below are what C1 uses to call Box on your users' beh - A Box account with permission to create and manage apps in the Box Developer Console, which typically requires an admin role. -If you don't see **Box** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Box** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Box app @@ -61,7 +61,7 @@ With per-user OAuth, you register one Box app and each user authorizes individua -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Box** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Box** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your app's **client ID** and **client secret**. @@ -77,7 +77,7 @@ A shared OAuth2 service app authenticates every user as one Box identity. Use th -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Box** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Box** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — service mode** and enter your app's **client ID** and **client secret**. @@ -94,13 +94,13 @@ How Box sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Box account, so tool calls run under that user's Box identity and inherit only the access they already have. Box attributes each action to the individual user. - **OAuth2 service mode.** Every user's tool calls use the one shared app you provided, so Box sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Box. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Box. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Box tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -110,5 +110,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Box credentials -- **Rotate the client secret** in your Box app in the Developer Console, then update the secret on the server's authentication settings in C1. +- **Rotate the client secret** in your Box app in the Developer Console, then update the secret on the source's authentication settings in C1. - **Adjust access** by editing the app's scopes in Box. diff --git a/product/admin/mcp-server/buildkite.mdx b/product/admin/mcp-server/buildkite.mdx index d5c9ec21..cf6a16de 100644 --- a/product/admin/mcp-server/buildkite.mdx +++ b/product/admin/mcp-server/buildkite.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Buildkite MCP server -description: Create a Buildkite API access token, then register the Buildkite MCP server in C1 and govern the tools it exposes. -og:title: Set up the Buildkite MCP server -og:description: Create a Buildkite API access token, then register the Buildkite MCP server in C1 and govern the tools it exposes. +title: Set up the Buildkite MCP source +description: Create a Buildkite API access token, then add Buildkite as a Catalog MCP source in C1 and govern the tools it exposes. +og:title: Set up the Buildkite MCP source +og:description: Create a Buildkite API access token, then add Buildkite as a Catalog MCP source in C1 and govern the tools it exposes. sidebarTitle: Buildkite --- @@ -12,7 +12,7 @@ sidebarTitle: Buildkite **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Buildkite MCP server lets you govern access to Buildkite — organizations, pipelines, builds, jobs, agents, and clusters — as tools your AI clients can call through C1. +The Buildkite Catalog MCP source lets you govern access to Buildkite — organizations, pipelines, builds, jobs, agents, and clusters — as tools your AI clients can call through C1. Buildkite authenticates with an API access token. A single token authenticates everyone, so all tool calls reach Buildkite as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Buildkite on your user - A Buildkite account that can create an API access token with access to the organizations you want to govern. -If you don't see **Buildkite** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Buildkite** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Buildkite API access token @@ -59,15 +59,15 @@ For a shared production setup, create the token from a dedicated service account Every user's tool calls use the one API access token you provided, so Buildkite sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated service account so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Buildkite MCP server in C1 +## Add the Buildkite Catalog MCP source in C1 -With your API access token ready, register the server and provide your credentials. +With your API access token ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Buildkite** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Buildkite** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your API access token. @@ -79,9 +79,9 @@ Save your changes. C1 starts a sync that discovers the tools the Buildkite serve ## Discover and govern tools -After you register the server, C1 runs tool discovery against Buildkite. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Buildkite. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Buildkite tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/confluence.mdx b/product/admin/mcp-server/confluence.mdx index bf1a92e7..5120ff72 100644 --- a/product/admin/mcp-server/confluence.mdx +++ b/product/admin/mcp-server/confluence.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Confluence MCP server -description: Connect Confluence to C1 with per-user OAuth, then register the Confluence MCP server and govern the tools it exposes. -og:title: Set up the Confluence MCP server -og:description: Connect Confluence to C1 with per-user OAuth, then register the Confluence MCP server and govern the tools it exposes. +title: Set up the Confluence MCP source +description: Connect Confluence to C1 with per-user OAuth, then add Confluence as a Catalog MCP source and govern the tools it exposes. +og:title: Set up the Confluence MCP source +og:description: Connect Confluence to C1 with per-user OAuth, then add Confluence as a Catalog MCP source and govern the tools it exposes. sidebarTitle: Confluence --- @@ -12,7 +12,7 @@ sidebarTitle: Confluence **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Confluence MCP server lets you govern access to Confluence Cloud — pages, blog posts, spaces, comments, attachments, whiteboards, groups, and users — as tools your AI clients can call through C1. +The Confluence Catalog MCP source lets you govern access to Confluence Cloud — pages, blog posts, spaces, comments, attachments, whiteboards, groups, and users — as tools your AI clients can call through C1. Confluence uses per-user OAuth, which is recommended: each person authorizes with their own Atlassian account, so every tool call runs under that user's identity and permissions. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Confluence on your use - An Atlassian account that can create an OAuth 2.0 integration. See Atlassian's [OAuth 2.0 (3LO) apps guide](https://developer.atlassian.com/cloud/confluence/oauth-2-3lo-apps/). -If you don't see **Confluence** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Confluence** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create an Atlassian OAuth 2.0 integration @@ -81,15 +81,15 @@ Atlassian recommends keeping an app under 50 scopes. Scope changes take effect t With per-user OAuth, each user authorizes with their own Atlassian account, so tool calls run under that user's Confluence identity and inherit only the access they already have. Atlassian attributes each action to the individual user. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Confluence MCP server in C1 +## Add the Confluence Catalog MCP source in C1 -With your OAuth 2.0 integration ready, register the server and provide its credentials. +With your OAuth 2.0 integration ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Confluence** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Confluence** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your integration's **client ID** and **client secret**. @@ -101,9 +101,9 @@ Save your changes. The first time a user calls a Confluence tool from their AI c ## Discover and govern tools -After you register the server, C1 runs tool discovery against Confluence. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Confluence. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Confluence tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -113,5 +113,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Confluence credentials -- **Rotate the OAuth client secret** in the Atlassian Developer Console under your integration's **Settings** tab, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in the Atlassian Developer Console under your integration's **Settings** tab, then update the secret on the source's authentication settings in C1. - **Adjust access** by editing the integration's Confluence scopes on the **Permissions** tab in the Atlassian Developer Console. diff --git a/product/admin/mcp-server/crowdstrike.mdx b/product/admin/mcp-server/crowdstrike.mdx index 419d36c2..c5180daf 100644 --- a/product/admin/mcp-server/crowdstrike.mdx +++ b/product/admin/mcp-server/crowdstrike.mdx @@ -1,8 +1,8 @@ --- -title: Set up the CrowdStrike MCP server -description: Create a CrowdStrike Falcon API client, then register the CrowdStrike MCP server in C1 and govern the tools your AI clients can call. -og:title: Set up the CrowdStrike MCP server -og:description: Create a CrowdStrike Falcon API client, then register the CrowdStrike MCP server in C1 and govern the tools your AI clients can call. +title: Set up the CrowdStrike MCP source +description: Create a CrowdStrike Falcon API client, then add CrowdStrike as a Catalog MCP source in C1 and govern the tools your AI clients can call. +og:title: Set up the CrowdStrike MCP source +og:description: Create a CrowdStrike Falcon API client, then add CrowdStrike as a Catalog MCP source in C1 and govern the tools your AI clients can call. sidebarTitle: CrowdStrike --- @@ -12,7 +12,7 @@ sidebarTitle: CrowdStrike **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The CrowdStrike MCP server lets you govern access to CrowdStrike Falcon — detections, incidents, hosts, vulnerabilities, and other data exposed by the Falcon API — as tools your AI clients can call through C1. +The CrowdStrike Catalog MCP source lets you govern access to CrowdStrike Falcon — detections, incidents, hosts, vulnerabilities, and other data exposed by the Falcon API — as tools your AI clients can call through C1. CrowdStrike authenticates with a Falcon API client using the OAuth2 client credentials flow. The API client's client ID and client secret authenticate every user, so all tool calls reach Falcon as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call CrowdStrike on your us - A CrowdStrike Falcon account with the **Falcon Administrator** role, or another role that can create API clients. -If you don't see **CrowdStrike** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **CrowdStrike** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a CrowdStrike Falcon API client @@ -60,15 +60,15 @@ For a shared production setup, use a dedicated API client so activity is attribu The API client authenticates every user as one shared Falcon identity, so CrowdStrike sees a single identity for all tool calls. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated API client so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the CrowdStrike MCP server in C1 +## Add the CrowdStrike Catalog MCP source in C1 -With your API client ready, register the server and provide your credentials. +With your API client ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **CrowdStrike** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **CrowdStrike** from the catalog. Enter your Falcon API base URL, such as `https://api.crowdstrike.com`. @@ -83,9 +83,9 @@ Save your changes. C1 starts a sync that discovers the tools the CrowdStrike ser ## Discover and govern tools -After you register the server, C1 runs tool discovery against CrowdStrike. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against CrowdStrike. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a CrowdStrike tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -95,5 +95,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your CrowdStrike credentials -- **Rotate the client secret** by resetting it on the API client in the Falcon console, then update the secret on the server's authentication settings in C1. +- **Rotate the client secret** by resetting it on the API client in the Falcon console, then update the secret on the source's authentication settings in C1. - **Adjust access** by editing the API scopes granted to the API client in CrowdStrike. diff --git a/product/admin/mcp-server/datadog.mdx b/product/admin/mcp-server/datadog.mdx index 4fe3da1b..d26faf80 100644 --- a/product/admin/mcp-server/datadog.mdx +++ b/product/admin/mcp-server/datadog.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Datadog MCP server -description: Create your Datadog API and application keys, then register the Datadog MCP server with C1 and configure authentication. -og:title: Set up the Datadog MCP server -og:description: Create your Datadog API and application keys, then register the Datadog MCP server with C1 and configure authentication. +title: Set up the Datadog MCP source +description: Create your Datadog API and application keys, then add Datadog as a Catalog MCP source in C1 and configure authentication. +og:title: Set up the Datadog MCP source +og:description: Create your Datadog API and application keys, then add Datadog as a Catalog MCP source in C1 and configure authentication. sidebarTitle: Datadog --- @@ -12,14 +12,14 @@ sidebarTitle: Datadog **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Datadog MCP server lets you govern access to the Datadog observability platform — metrics, monitors, dashboards, logs, security signals, incidents, and more — as tools your AI clients can call through C1. +The Datadog Catalog MCP source lets you govern access to the Datadog observability platform — metrics, monitors, dashboards, logs, security signals, incidents, and more — as tools your AI clients can call through C1. Datadog authenticates with two credentials that work together: - An **API key** identifies your organization to Datadog. - An **application key** authorizes a user or role to read and write data. -Most Datadog endpoints need both, so you'll create each one in Datadog and then provide them to C1 when you register the server. +Most Datadog endpoints need both, so you'll create each one in Datadog and then provide them to C1 when you add the source. ## How C1 connects to Datadog @@ -35,7 +35,7 @@ The credentials you set up below are what C1 uses to call Datadog on your users' ## Find your Datadog site -Datadog hosts each organization on a regional site with its own API host. You'll select this site when you register the server in C1. To find yours, match the host in your browser's address bar while you're signed in to Datadog. +Datadog hosts each organization on a regional site with its own API host. You'll select this site when you add the source in C1. To find yours, match the host in your browser's address bar while you're signed in to Datadog. | Site | Web host | API host | | :--- | :--- | :--- | @@ -65,7 +65,7 @@ Go to **Organization Settings** > **API Keys**. Select **New Key**, give it a recognizable name such as `C1`, and select **Create API key**. -Copy the key and store it safely. You'll add it to C1 when you register the server. +Copy the key and store it safely. You'll add it to C1 when you add the source. @@ -100,15 +100,15 @@ The Datadog MCP server uses a single shared credential. The API key and applicat To keep that shared identity attributable to C1 rather than a person, create the application key from a dedicated service-account user, as described in [Create a Datadog application key](#create-a-datadog-application-key). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Datadog MCP server in C1 +## Add the Datadog Catalog MCP source in C1 -With both keys ready, register the server and provide your credentials. +With both keys ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Datadog** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Datadog** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), provide the credentials Datadog needs: @@ -124,9 +124,9 @@ Save your changes. C1 starts a sync that discovers the tools the Datadog server ## Discover and govern tools -After you register the server, C1 runs tool discovery against Datadog. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Datadog. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification) for details. +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification) for details. Before anyone can call a Datadog tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to complete this setup. @@ -136,8 +136,8 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Datadog credentials -You can rotate either key or adjust the application key's scopes at any time without re-registering the server. +You can rotate either key or adjust the application key's scopes at any time without re-adding the source. -- **Rotate the API key** in **Organization Settings** > **API Keys** in Datadog, then update the credential on the server's authentication settings in C1. +- **Rotate the API key** in **Organization Settings** > **API Keys** in Datadog, then update the credential on the source's authentication settings in C1. - **Rotate the application key** the same way under **Application Keys**. If you used a service-account user, keep that account active so the key stays valid. - **Adjust scopes** at any time by editing the application key's authorization scopes in Datadog. diff --git a/product/admin/mcp-server/freshdesk.mdx b/product/admin/mcp-server/freshdesk.mdx index e8676827..6c1cbb44 100644 --- a/product/admin/mcp-server/freshdesk.mdx +++ b/product/admin/mcp-server/freshdesk.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Freshdesk MCP server -description: Create Freshdesk basic auth credentials and register the Freshdesk MCP server in C1 so AI clients can call governed Freshdesk tools. -og:title: Set up the Freshdesk MCP server -og:description: Create Freshdesk basic auth credentials and register the Freshdesk MCP server in C1 so AI clients can call governed Freshdesk tools. +title: Set up the Freshdesk MCP source +description: Create Freshdesk basic auth credentials and add Freshdesk as a Catalog MCP source in C1 so AI clients can call governed Freshdesk tools. +og:title: Set up the Freshdesk MCP source +og:description: Create Freshdesk basic auth credentials and add Freshdesk as a Catalog MCP source in C1 so AI clients can call governed Freshdesk tools. sidebarTitle: Freshdesk --- @@ -12,7 +12,7 @@ sidebarTitle: Freshdesk **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Freshdesk MCP server lets you govern access to Freshdesk — tickets, contacts, companies, and other support data — as tools your AI clients can call through C1. +The Freshdesk Catalog MCP source lets you govern access to Freshdesk — tickets, contacts, companies, and other support data — as tools your AI clients can call through C1. Freshdesk authenticates with basic auth, using a Freshdesk API key as the username. A single credential authenticates everyone, so all tool calls reach Freshdesk as one shared identity. Create the API key from a dedicated service-account agent so activity is attributable to C1 rather than a person. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Freshdesk on your user - A Freshdesk agent account with the API access and role needed for the tools you plan to govern. -If you don't see **Freshdesk** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Freshdesk** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Find your Freshdesk API key @@ -50,15 +50,15 @@ Freshdesk basic auth uses your API key as the username. Freshdesk ignores the pa Every user's tool calls use the one API key you provided, so Freshdesk sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared production setup, create the API key from a dedicated service-account agent so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Freshdesk MCP server in C1 +## Add the Freshdesk Catalog MCP source in C1 -With your API key ready, register the server and provide your credentials. +With your API key ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Freshdesk** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Freshdesk** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Basic auth**, enter your Freshdesk API key as the username, and enter any placeholder such as `X` as the password. @@ -70,9 +70,9 @@ Save your changes. C1 starts a sync that discovers the tools the Freshdesk serve ## Discover and govern tools -After you register the server, C1 runs tool discovery against Freshdesk. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Freshdesk. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Freshdesk tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -82,5 +82,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Freshdesk credentials -- **Rotate the API key** by resetting it in Freshdesk, then update the username on the server's authentication settings in C1. +- **Rotate the API key** by resetting it in Freshdesk, then update the username on the source's authentication settings in C1. - **Adjust access** by changing the role of the agent whose API key you use. diff --git a/product/admin/mcp-server/github.mdx b/product/admin/mcp-server/github.mdx index df0b8b55..731376db 100644 --- a/product/admin/mcp-server/github.mdx +++ b/product/admin/mcp-server/github.mdx @@ -1,8 +1,8 @@ --- -title: Set up the GitHub MCP server -description: Connect GitHub to C1 through the GitHub API or GitHub's own hosted MCP server, then register the server and govern its tools. -og:title: Set up the GitHub MCP server -og:description: Connect GitHub to C1 through the GitHub API or GitHub's own hosted MCP server, then register the server and govern its tools. +title: Set up the GitHub MCP source +description: Connect GitHub to C1 through the GitHub API or GitHub's own hosted MCP server, then add the Catalog MCP source and govern its tools. +og:title: Set up the GitHub MCP source +og:description: Connect GitHub to C1 through the GitHub API or GitHub's own hosted MCP server, then add the Catalog MCP source and govern its tools. sidebarTitle: GitHub --- @@ -12,9 +12,9 @@ sidebarTitle: GitHub **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern GitHub access two ways. Both let your AI clients read from and act on GitHub through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: +C1 can govern GitHub access two ways. Both let your AI clients read from and act on GitHub through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog: -- **GitHub MCP** — listed as plain **GitHub** in your catalog. C1 registers GitHub's own hosted MCP server (`api.githubcopilot.com`) as a downstream server C1 governs. GitHub doesn't support dynamic client registration (DCR), so authentication is per-user OAuth through a GitHub OAuth App you register once, or a shared personal access token. Tool calls run with the connected user's granted OAuth scopes (or the token's permissions), against GitHub's own broader tool set — including cross-item search, discussions, and security alerts. +- **GitHub MCP** — listed as plain **GitHub** in your catalog. C1 adds GitHub's own hosted MCP server (`api.githubcopilot.com`) as a Catalog MCP source. GitHub doesn't support dynamic client registration (DCR), so authentication is per-user OAuth through a GitHub OAuth App you register once, or a shared personal access token. Tool calls run with the connected user's granted OAuth scopes (or the token's permissions), against GitHub's own broader tool set — including cross-item search, discussions, and security alerts. - **GitHub API** — C1 hosts its own MCP server that translates GitHub's REST API into tools. You choose between per-user OAuth or a shared personal access token, and access follows the OAuth app's requested scopes or the token's repository permissions. | | GitHub MCP | GitHub API | @@ -23,7 +23,7 @@ C1 can govern GitHub access two ways. Both let your AI clients read from and act | **Authentication** | Per-user OAuth (no dynamic client registration — requires a GitHub OAuth App), or a personal access token | Per-user OAuth (requires a GitHub OAuth App), or a personal access token | | **Access scoping** | The OAuth scopes granted at authorization, or the personal access token's permissions | The OAuth app's requested scopes, or the personal access token's repository permissions | | **Tool surface** | GitHub's own tool set: repositories, issues, pull requests, Actions workflows, discussions, security alerts, and notifications | Repositories, pull requests, issues, Actions, and organization data, mapped to GitHub API endpoints | -| **Setup effort** | Register a GitHub OAuth App (or generate a token), then register in C1 | Register a GitHub OAuth App (or generate a token), then register in C1 | +| **Setup effort** | Register a GitHub OAuth App (or generate a token), then add the source in C1 | Register a GitHub OAuth App (or generate a token), then add the source in C1 | Use the native **GitHub MCP** option (listed as plain **GitHub** in your catalog) if you want GitHub's own broader, agentic tool set, including cross-item search, discussions, and security alerts. Use **GitHub API** if you want C1's own curated tool surface mapped directly to GitHub API endpoints. @@ -40,12 +40,12 @@ C1 registers as a client of GitHub's own hosted MCP server ([GitHub MCP Server]( - If you'd rather not register an OAuth App, this option also accepts a GitHub personal access token as a shared bearer credential. See **Use a personal access token instead** below. -In your MCP server catalog, this option is listed as **GitHub** — distinct from the **GitHub API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **GitHub** — distinct from the **GitHub API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Set up per-user OAuth -Per-user OAuth is the recommended way to connect — each user authorizes individually, and every tool call runs under their own GitHub identity and permissions. Unlike C1's other native MCP integrations, GitHub doesn't support dynamic client registration for this server, so you need to register a GitHub OAuth App yourself before C1 can prompt users to connect. +Per-user OAuth is the recommended way to connect — each user authorizes individually, and every tool call runs under their own GitHub identity and permissions. Unlike C1's other Catalog MCP sources, GitHub doesn't support dynamic client registration for this server, so you need to register a GitHub OAuth App yourself before C1 can prompt users to connect. First, create a GitHub OAuth App that users will authorize through: @@ -65,11 +65,11 @@ Select **Register application**, then copy the **Client ID**. Select **Generate -With your OAuth app ready, register the server and provide its credentials: +With your OAuth app ready, add the source and provide its credentials: -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **GitHub** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **GitHub** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enter your OAuth app's **client ID** and **client secret**. @@ -107,7 +107,7 @@ In GitHub, generate a token under **Settings** > **Developer settings** > **Pers Copy the token — GitHub shows it only once. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **GitHub** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **GitHub** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste the token. C1 sends it as `Authorization: Bearer ` on every request. @@ -121,9 +121,9 @@ When you [configure authentication](/product/admin/mcp-servers#configure-authent ## Discover and govern tools -After you register the server, C1 runs tool discovery against GitHub's hosted MCP server. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against GitHub's hosted MCP server. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a GitHub tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -133,7 +133,7 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove ## Manage access to GitHub MCP -- **Rotate the OAuth client secret** on your OAuth app's settings page in GitHub (**Settings** > **Developer settings** > **OAuth Apps**), then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** on your OAuth app's settings page in GitHub (**Settings** > **Developer settings** > **OAuth Apps**), then update the secret on the source's authentication settings in C1. - **Rotate a personal access token** by generating a new one in GitHub and updating it in C1. Set an expiration on the token so it rotates on a schedule. - **An individual user can revoke their own authorization at any time.** In GitHub, go to **Settings** > **Applications** > **Authorized OAuth Apps**, then select **Revoke** next to C1 ([reviewing your authorized OAuth apps](https://docs.github.com/en/apps/oauth-apps/using-oauth-apps/reviewing-your-authorized-oauth-apps)). - **An organization owner can restrict or revoke OAuth App access org-wide** if the organization has third-party application access restrictions enabled ([about OAuth App access restrictions](https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/about-oauth-app-access-restrictions)). @@ -144,7 +144,7 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove C1 hosts the GitHub MCP server, so your users' AI clients only ever see MCP tools — they never call GitHub directly. When an AI client calls one of these tools, C1 makes the matching request to the GitHub API using the credentials you configure here, then returns the result to the AI client. The credentials you set up below are what C1 uses to call GitHub on your users' behalf. -GitHub supports two ways to authenticate, and you choose one when you register the server: +GitHub supports two ways to authenticate, and you choose one when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own GitHub account, so every tool call runs under that user's GitHub identity and permissions. - **Personal access token**. A single token authenticates everyone, so all tool calls reach GitHub as one shared identity. @@ -158,7 +158,7 @@ For a deeper comparison of shared versus per-user credentials, see [Configure au - For a personal access token, you need the GitHub account whose access the token should carry. -In your MCP server catalog, this option is listed as **GitHub API** — distinct from the **GitHub** entry, which connects to GitHub's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **GitHub API** — distinct from the **GitHub** entry, which connects to GitHub's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -188,13 +188,13 @@ Copy the **Client ID**, then select **Generate a new client secret** and copy th -### Register the server with OAuth +### Add the source with OAuth -With your OAuth app ready, register the server and provide its credentials. +With your OAuth app ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **GitHub API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **GitHub API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your OAuth app's **client ID** and **client secret**. @@ -229,13 +229,13 @@ Select **Generate token** and copy it. GitHub shows the token only once. For a shared production setup, create the token from a dedicated service-account user so activity is attributable to C1 rather than a person. -### Register the server with a token +### Add the source with a token -With your token ready, register the server and provide it as the credential. +With your token ready, add the source and provide it as the credential. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **GitHub API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **GitHub API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your personal access token. @@ -252,13 +252,13 @@ How GitHub sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own GitHub account, so tool calls run under that user's GitHub identity and inherit only the access they already have. GitHub attributes each action to the individual user. - **Personal access token.** Every user's tool calls use the one token you provided, so GitHub sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against GitHub. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against GitHub. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a GitHub tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -268,7 +268,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your GitHub credentials -- **Rotate the OAuth client secret** in your GitHub OAuth app under **Settings** > **Developer settings** > **OAuth Apps**, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your GitHub OAuth app under **Settings** > **Developer settings** > **OAuth Apps**, then update the secret on the source's authentication settings in C1. - **Rotate a personal access token** by generating a new one in GitHub and updating it in C1. Set an expiration on the token so it rotates on a schedule. - **Adjust access** by editing the OAuth app's scopes or the token's repository permissions in GitHub. diff --git a/product/admin/mcp-server/gong.mdx b/product/admin/mcp-server/gong.mdx index 8916958d..b4b53373 100644 --- a/product/admin/mcp-server/gong.mdx +++ b/product/admin/mcp-server/gong.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Gong MCP server -description: Generate Gong API credentials, then register the Gong MCP server in C1 and govern the tools your AI clients can call. -og:title: Set up the Gong MCP server -og:description: Generate Gong API credentials, then register the Gong MCP server in C1 and govern the tools your AI clients can call. +title: Set up the Gong MCP source +description: Generate Gong API credentials, then add Gong as a Catalog MCP source in C1 and govern the tools your AI clients can call. +og:title: Set up the Gong MCP source +og:description: Generate Gong API credentials, then add Gong as a Catalog MCP source in C1 and govern the tools your AI clients can call. sidebarTitle: Gong --- @@ -12,7 +12,7 @@ sidebarTitle: Gong **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Gong MCP server lets you govern access to Gong — calls, transcripts, users, scorecards, deals, sequences, and permission profiles — as tools your AI clients can call through C1. +The Gong Catalog MCP source lets you govern access to Gong — calls, transcripts, users, scorecards, deals, sequences, and permission profiles — as tools your AI clients can call through C1. Gong authenticates with a generated Access Key and Access Key Secret pair that C1 sends as HTTP basic auth. A single credential pair authenticates everyone, so all tool calls reach Gong as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Gong on your users' be - A Gong **Technical Administrator** account. Only a Technical Administrator can generate API credentials. If you don't have that role, find your Gong tech admin in Gong's [Find your Technical or Business Admin](https://help.gong.io/v1/docs/find-your-technical-or-business-admin) help article. -If you don't see **Gong** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Gong** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Generate Gong API credentials @@ -59,15 +59,15 @@ For a shared production setup, generate the credentials under a dedicated servic Every user's tool calls use the one Access Key and Access Key Secret pair you provided, so Gong sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared production setup, generate the credentials from a dedicated service-account user so Gong activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Gong MCP server in C1 +## Add the Gong Catalog MCP source in C1 -With your credential pair ready, register the server and provide your credentials. +With your credential pair ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Gong** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Gong** from the catalog. Enter your Gong instance URL, such as `https://acme.api.gong.io`. @@ -82,9 +82,9 @@ Save your changes. C1 starts a sync that discovers the tools the Gong server exp ## Discover and govern tools -After you register the server, C1 runs tool discovery against Gong. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Gong. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Gong tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/google-analytics-admin.mdx b/product/admin/mcp-server/google-analytics-admin.mdx index 51f956fb..68c6d119 100644 --- a/product/admin/mcp-server/google-analytics-admin.mdx +++ b/product/admin/mcp-server/google-analytics-admin.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Google Analytics Admin MCP server -description: Connect Google Analytics Admin to C1 with per-user OAuth or a service account, then register the MCP server and govern its tools. -og:title: Set up the Google Analytics Admin MCP server -og:description: Connect Google Analytics Admin to C1 with per-user OAuth or a service account, then register the MCP server and govern its tools. +title: Set up the Google Analytics Admin MCP source +description: Connect Google Analytics Admin to C1 with per-user OAuth or a service account, then add the Catalog MCP source and govern its tools. +og:title: Set up the Google Analytics Admin MCP source +og:description: Connect Google Analytics Admin to C1 with per-user OAuth or a service account, then add the Catalog MCP source and govern its tools. sidebarTitle: Google Analytics Admin --- @@ -12,9 +12,9 @@ sidebarTitle: Google Analytics Admin **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Google Analytics Admin MCP server lets you govern access to Google Analytics 4 configuration — accounts, properties, data streams, custom dimensions, conversions, and account-level user permissions — as tools your AI clients can call through C1. +The Google Analytics Admin Catalog MCP source lets you govern access to Google Analytics 4 configuration — accounts, properties, data streams, custom dimensions, conversions, and account-level user permissions — as tools your AI clients can call through C1. -Google Analytics Admin supports two ways to authenticate, and you choose one when you register the server: +Google Analytics Admin supports two ways to authenticate, and you choose one when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own Google account, so every tool call runs under that user's Analytics identity and permissions. - **Service account**. A single Google service account authenticates everyone, so all tool calls reach Analytics as one shared identity. @@ -30,15 +30,15 @@ The credentials you set up below are what C1 uses to call Google Analytics Admin ## Before you begin - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management). -- A Google Cloud project, set up as described in [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup) (enable the Google Analytics Admin API, create OAuth credentials, and grant users the **Service Usage Consumer** role on the quota project). +- A Google Cloud project, set up as described in [Set up a Google Cloud project for MCP sources](/product/admin/mcp-server/google-cloud-project-setup) (enable the Google Analytics Admin API, create OAuth credentials, and grant users the **Service Usage Consumer** role on the quota project). - The right GA4 role for the operations you need. Reads need at least **Viewer**, edits and creates need **Editor** at the property level or **Administrator** at the account level, and managing GA4 user permissions needs **Administrator** at the account level. -If you don't see **Google Analytics Admin** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Google Analytics Admin** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. -The Cloud Console setup is the same as the Google Analytics MCP server. Most deployments register a single OAuth client or service account and grant it both the Data API and Admin API scopes, so you don't need separate Cloud projects. +The Cloud Console setup is the same as the Google Analytics MCP source. Most deployments register a single OAuth client or service account and grant it both the Data API and Admin API scopes, so you don't need separate Cloud projects. ## Option 1: Set up per-user OAuth @@ -72,13 +72,13 @@ Select **Create**, then copy the **Client ID** and **Client secret**. Google sho Confirm that each user who authorizes has the GA4 role needed for the operations C1 should perform, in the GA4 Admin UI under **Account Access Management** or **Property Access Management**. -### Register the server with OAuth +### Add the source with OAuth -With your OAuth client ready, register the server and provide its credentials. +With your OAuth client ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Analytics Admin** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Google Analytics Admin** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your OAuth client's **client ID** and **client secret**, plus the scopes you configured. Also enter the **Google Cloud Quota Project ID** — the ID of the project where you enabled the Google Analytics Admin API and granted users the Service Usage Consumer role. @@ -108,13 +108,13 @@ In each GA4 property's **Admin** > **Property Access Management**, add the servi -### Register the server with a service account +### Add the source with a service account -With your service account key ready, register the server and provide it as the credential. +With your service account key ready, add the source and provide it as the credential. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Analytics Admin** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Google Analytics Admin** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **JWT Bearer (RFC 7523)** and provide the service account's JSON key and the scopes you need, such as `analytics.readonly` and `analytics.edit`. @@ -131,13 +131,13 @@ How Google Analytics sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Google account, so tool calls run under that user's Analytics identity and inherit only the access they already have. Google attributes each action to the individual user. - **Service account.** Every user's tool calls use the one service account you configured, so Analytics sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Google Analytics Admin. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Google Analytics Admin. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Google Analytics Admin tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -147,6 +147,6 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Google Analytics Admin credentials -- **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the source's authentication settings in C1. - **Rotate the service account key** by generating a new JSON key in the Cloud Console, updating it in C1, then deleting the old key. - **Adjust access** by editing the OAuth client's scopes, or by changing the service account's role in **Account Access Management** or **Property Access Management**. diff --git a/product/admin/mcp-server/google-analytics.mdx b/product/admin/mcp-server/google-analytics.mdx index 08d71198..517ae943 100644 --- a/product/admin/mcp-server/google-analytics.mdx +++ b/product/admin/mcp-server/google-analytics.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Google Analytics MCP server -description: Connect Google Analytics to C1 with per-user OAuth or a service account, then register the Google Analytics MCP server and govern its tools. -og:title: Set up the Google Analytics MCP server -og:description: Connect Google Analytics to C1 with per-user OAuth or a service account, then register the Google Analytics MCP server and govern its tools. +title: Set up the Google Analytics MCP source +description: Connect Google Analytics to C1 with per-user OAuth or a service account, then add Google Analytics as a Catalog MCP source and govern its tools. +og:title: Set up the Google Analytics MCP source +og:description: Connect Google Analytics to C1 with per-user OAuth or a service account, then add Google Analytics as a Catalog MCP source and govern its tools. sidebarTitle: Google Analytics --- @@ -12,9 +12,9 @@ sidebarTitle: Google Analytics **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Google Analytics MCP server lets you govern access to Google Analytics 4 report data — dimensions, metrics, realtime events, pivot reports, and audience exports — as tools your AI clients can call through C1. +The Google Analytics Catalog MCP source lets you govern access to Google Analytics 4 report data — dimensions, metrics, realtime events, pivot reports, and audience exports — as tools your AI clients can call through C1. -Google Analytics supports two ways to authenticate, and you choose one when you register the server: +Google Analytics supports two ways to authenticate, and you choose one when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own Google account, so every tool call runs under that user's Analytics identity and permissions. - **Service account**. A single Google service account authenticates everyone, so all tool calls reach Analytics as one shared identity. @@ -30,11 +30,11 @@ The credentials you set up below are what C1 uses to call Google Analytics on yo ## Before you begin - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management). -- A Google Cloud project, set up as described in [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup) (enable the Google Analytics Data API, create OAuth credentials, and grant users the **Service Usage Consumer** role on the quota project). +- A Google Cloud project, set up as described in [Set up a Google Cloud project for MCP sources](/product/admin/mcp-server/google-cloud-project-setup) (enable the Google Analytics Data API, create OAuth credentials, and grant users the **Service Usage Consumer** role on the quota project). - Access to the GA4 properties you want to query. The user or service account must already have at least **Viewer** access on those properties. -If you don't see **Google Analytics** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Google Analytics** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -68,13 +68,13 @@ Select **Create**, then copy the **Client ID** and **Client secret**. Google sho Confirm that each user who authorizes already has access to the GA4 properties they want to query, in the GA4 Admin UI under **Property Access Management**. -### Register the server with OAuth +### Add the source with OAuth -With your OAuth client ready, register the server and provide its credentials. +With your OAuth client ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Analytics** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Google Analytics** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your OAuth client's **client ID** and **client secret**, plus the scopes you configured. Also enter the **Google Cloud Quota Project ID** — the ID of the project where you enabled the Google Analytics Data API and granted users the Service Usage Consumer role. @@ -104,13 +104,13 @@ In each GA4 property's **Admin** > **Property Access Management**, add the servi -### Register the server with a service account +### Add the source with a service account -With your service account key ready, register the server and provide it as the credential. +With your service account key ready, add the source and provide it as the credential. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Analytics** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Google Analytics** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — JWT bearer** and provide the service account's JSON key and the scopes you need, such as `analytics.readonly`. @@ -127,13 +127,13 @@ How Google Analytics sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Google account, so tool calls run under that user's Analytics identity and inherit only the access they already have. Google attributes each action to the individual user. - **Service account.** Every user's tool calls use the one service account you configured, so Analytics sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Google Analytics. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Google Analytics. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Google Analytics tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -143,6 +143,6 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Google Analytics credentials -- **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the source's authentication settings in C1. - **Rotate the service account key** by generating a new JSON key in the Cloud Console, updating it in C1, then deleting the old key. - **Adjust access** by editing the OAuth client's scopes, or by changing the service account's role in each GA4 property's **Property Access Management**. diff --git a/product/admin/mcp-server/google-cloud-project-setup.mdx b/product/admin/mcp-server/google-cloud-project-setup.mdx index 694318ff..9c417ef2 100644 --- a/product/admin/mcp-server/google-cloud-project-setup.mdx +++ b/product/admin/mcp-server/google-cloud-project-setup.mdx @@ -1,14 +1,14 @@ --- -title: Set up a Google Cloud project for MCP servers -description: Create and configure the Google Cloud project that every Google MCP server shares — enable APIs, grant users permission to use the project, and create OAuth credentials. -og:title: Set up a Google Cloud project for MCP servers -og:description: Create and configure the Google Cloud project that every Google MCP server shares — enable APIs, grant users permission to use the project, and create OAuth credentials. +title: Set up a Google Cloud project for MCP sources +description: Create and configure the Google Cloud project that every Google MCP source shares — enable APIs, grant users permission to use the project, and create OAuth credentials. +og:title: Set up a Google Cloud project for MCP sources +og:description: Create and configure the Google Cloud project that every Google MCP source shares — enable APIs, grant users permission to use the project, and create OAuth credentials. sidebarTitle: Google Cloud project setup --- {/* Editor Refresh: 2026-07-16 */} -Set up one Google Cloud project and reuse it for every Google MCP server — Google Drive, Docs, Sheets, Slides, Gmail, Calendar, and the rest. Each Google server connects through a **Google Cloud project** that you own, and a single project can back all of them. +Set up one Google Cloud project and reuse it for every Google MCP source — Google Drive, Docs, Sheets, Slides, Gmail, Calendar, and the rest. Each source connects through a **Google Cloud project** that you own, and a single project can back all of them. ## Before you begin @@ -22,9 +22,9 @@ When a user's AI client calls a Google tool, C1 makes the matching request to th | What | Why it matters | | :--- | :--- | -| **Enabled APIs** | Each connector calls a specific Google API (for example, the Gmail API). That API must be enabled in your project. | +| **Enabled APIs** | Each source calls a specific Google API (for example, the Gmail API). That API must be enabled in your project. | | **OAuth client** | The client ID and secret C1 uses to let each user authorize with their own Google account. | -| **Quota project** | The project that Google attributes each request's quota and billing to. You enter this as the **Google Cloud Quota Project ID** when you register the server, and every caller must be allowed to use it. | +| **Quota project** | The project that Google attributes each request's quota and billing to. You enter this as the **Google Cloud Quota Project ID** when you add the source, and every caller must be allowed to use it. | The third item is the one most often missed — see [Grant users permission to use the project](#grant-users-permission-to-use-the-project). Skipping it is the most common cause of a failed Google connection. @@ -37,18 +37,18 @@ Pick the project that will own your OAuth credentials and receive API quota. It Sign in to the [Google Cloud console](https://console.cloud.google.com/). -Create a new project for C1, or select an existing one. Note its **Project ID** (for example, `acme-c1-mcp`) — you'll enter this exact value when you register each Google server. +Create a new project for C1, or select an existing one. Note its **Project ID** (for example, `acme-c1-mcp`) — you'll enter this exact value when you add each Google source. **Optional.** The Workspace APIs in this guide don't require a billing account. If you plan to use a billing-gated Google API or need higher quota limits, link a billing account to the project. -## Enable the APIs for your connectors +## Enable the APIs for your sources -Enable one API per Google connector you plan to use. In the console, go to **APIs & Services** > **Library**, search for the API by name, and select **Enable**. The service ID is the identifier you use with the `gcloud` CLI. +Enable one API per Google source you plan to use. In the console, go to **APIs & Services** > **Library**, search for the API by name, and select **Enable**. The service ID is the identifier you use with the `gcloud` CLI. -| Connector | API to enable | Service ID | +| Source | API to enable | Service ID | | :--- | :--- | :--- | | Google Drive | Google Drive API | `drive.googleapis.com` | | Google Docs | Google Docs API | `docs.googleapis.com` | @@ -66,7 +66,7 @@ Enable one API per Google connector you plan to use. In the console, go to **API | Google Analytics Admin | Google Analytics Admin API | `analyticsadmin.googleapis.com` | -Enable only the APIs for the connectors you actually register. If a connector's API isn't enabled, its tool calls fail with a `SERVICE_DISABLED` error telling you to enable that API in the project. +Enable only the APIs for the sources you actually add. If a source's API isn't enabled, its tool calls fail with a `SERVICE_DISABLED` error telling you to enable that API in the project. To enable the APIs from the command line instead, pass the service IDs to `gcloud`. This example enables the full set — drop any you don't need: @@ -98,7 +98,7 @@ gcloud services list --enabled --project=YOUR_PROJECT_ID ## Grant users permission to use the project -When you register a Google server with **per-user OAuth**, each person authenticates as themselves — so *each user* is the caller Google checks. Because you set a **Quota Project ID**, every request carries that project as its quota project, and Google requires the caller to hold the `serviceusage.services.use` permission on it. +When you add a Google MCP source with **per-user OAuth**, each person authenticates as themselves — so *each user* is the caller Google checks. Because you set a **Quota Project ID**, every request carries that project as its quota project, and Google requires the caller to hold the `serviceusage.services.use` permission on it. If a user doesn't have it, their tool calls fail with: @@ -114,7 +114,7 @@ Because every user needs this, grant it to a **Google group** that contains all -Create (or choose) a Google group that contains everyone who will use your Google MCP servers — for example, an all-employees group. +Create (or choose) a Google group that contains everyone who will use your Google MCP sources — for example, an all-employees group. In the Google Cloud console, go to **IAM & Admin** > **IAM**, select **Grant access**, enter the group's email as the principal, and assign the **Service Usage Consumer** role. See Google's [Grant a role](https://cloud.google.com/iam/docs/grant-role-console) documentation. @@ -153,7 +153,7 @@ Choose the audience: - **External** — any Google account. Broad Google Workspace scopes are **restricted** and require Google verification before an External app can be used outside your organization. -Add the scopes your connectors need — see [OAuth scopes by connector](#oauth-scopes-by-connector) for the full list per connector. Request only the scopes you need; for read-only use, prefer the narrower `.readonly` scopes. See Google's [Configure the OAuth consent screen](https://developers.google.com/workspace/guides/configure-oauth-consent) documentation. +Add the scopes your sources need — see [OAuth scopes by source](#oauth-scopes-by-source) for the full list per source. Request only the scopes you need; for read-only use, prefer the narrower `.readonly` scopes. See Google's [Configure the OAuth consent screen](https://developers.google.com/workspace/guides/configure-oauth-consent) documentation. @@ -185,9 +185,9 @@ Select **Create**, then copy the **Client ID** and **Client secret**. Google sho If your users are on Google Workspace, an administrator may also need to allow the OAuth client under **Admin Console** > **Security** > **Access and data control** > **API controls** > **App access control**. -## OAuth scopes by connector +## OAuth scopes by source -Add the scopes for each connector you use — to the consent screen for per-user OAuth, or to domain-wide delegation for a service account. Each list below is the full set that connector's tools can use. Grant only what your deployment needs, and prefer the `.readonly` scopes for read-only use. +Add the scopes for each source you use — to the consent screen for per-user OAuth, or to domain-wide delegation for a service account. Each list below is the full set that source's tools can use. Grant only what your deployment needs, and prefer the `.readonly` scopes for read-only use. @@ -386,29 +386,29 @@ In the Google Cloud console, go to **APIs & Services** > **Credentials** > **Cre Note the service account's numeric **Unique ID**. -As a Workspace administrator, go to **Admin Console** > **Security** > **Access and data control** > **API controls** > **Domain-wide delegation**, select **Add new**, and enter the Unique ID along with the scopes your connectors need. +As a Workspace administrator, go to **Admin Console** > **Security** > **Access and data control** > **API controls** > **Domain-wide delegation**, select **Add new**, and enter the Unique ID along with the scopes your sources need. Grant the service account the **Service Usage Consumer** role on your project (see [Grant users permission to use the project](#grant-users-permission-to-use-the-project)) so its requests can use the quota project. -## Register your Google servers +## Add your Google MCP sources -With the project ready, register each Google MCP server. During [authentication setup](/product/admin/mcp-servers#configure-authentication), you provide: +With the project ready, add each Google MCP source. During [authentication setup](/product/admin/mcp-servers#configure-authentication), you provide: - The **Google Cloud Quota Project ID** — the Project ID from [Create or select a project](#create-or-select-a-project). - For per-user OAuth: the **client ID**, **client secret**, and the **scopes** you configured. - For a service account: the **JSON key** and the scopes you delegated. -Then follow the connector-specific page for anything unique to that server: +Then follow the source-specific page for anything unique to that source: - [Google Drive](/product/admin/mcp-server/google-drive) - [Google Analytics](/product/admin/mcp-server/google-analytics) - [Google Analytics Admin](/product/admin/mcp-server/google-analytics-admin) -Connectors without a dedicated page above use the same [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) flow. If a Google connector you want isn't in your catalog yet, [contact the C1 support team](mailto:support@c1.ai). +Sources without a dedicated page above use the same [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) flow. If a Google source you want isn't in your catalog yet, [contact the C1 support team](mailto:support@c1.ai). ## Troubleshoot Google Cloud project errors @@ -416,7 +416,7 @@ Connectors without a dedicated page above use the same [Register an MCP server]( | Symptom | Cause | Fix | | :--- | :--- | :--- | | `PERMISSION_DENIED: Caller does not have required permission to use project ...` | The caller lacks `serviceusage.services.use` on the quota project. | Grant the **Service Usage Consumer** role — see [Grant users permission to use the project](#grant-users-permission-to-use-the-project). | -| `SERVICE_DISABLED` / "API has not been used in project ... before or it is disabled" | The connector's API isn't enabled in the quota project. | Enable it — see [Enable the APIs for your connectors](#enable-the-apis-for-your-connectors). | +| `SERVICE_DISABLED` / "API has not been used in project ... before or it is disabled" | The source's API isn't enabled in the quota project. | Enable it — see [Enable the APIs for your sources](#enable-the-apis-for-your-sources). | | Authorization flow fails after the user consents | The redirect URI doesn't match. | Set it to exactly `https://accounts.conductor.one/auth/callback` — see [Create the client credentials](#create-the-client-credentials). | | A restricted-scope warning blocks External users | The app needs Google verification for restricted scopes. | Use an **Internal** consent screen for Workspace-only use, or complete Google's verification for External use. | | "Google hasn't verified this app" blocks sign-in | The External app isn't verified and the user isn't a test user. | Add the user as a **test user** on the consent screen, or complete Google's verification. | diff --git a/product/admin/mcp-server/google-drive.mdx b/product/admin/mcp-server/google-drive.mdx index 92150c97..032ec370 100644 --- a/product/admin/mcp-server/google-drive.mdx +++ b/product/admin/mcp-server/google-drive.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Google Drive MCP server -description: Connect Google Drive to C1 through the Google Drive API or Google's own hosted MCP server, then register the server and govern its tools. -og:title: Set up the Google Drive MCP server -og:description: Connect Google Drive to C1 through the Google Drive API or Google's own hosted MCP server, then register the server and govern its tools. +title: Set up the Google Drive MCP source +description: Connect Google Drive to C1 through the Google Drive API or Google's own hosted MCP server, then add the Catalog MCP source and govern its tools. +og:title: Set up the Google Drive MCP source +og:description: Connect Google Drive to C1 through the Google Drive API or Google's own hosted MCP server, then add the Catalog MCP source and govern its tools. sidebarTitle: Google Drive --- @@ -12,9 +12,9 @@ sidebarTitle: Google Drive **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern Google Drive access two ways. Both let your AI clients read from and act on Drive through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: +C1 can govern Google Drive access two ways. Both let your AI clients read from and act on Drive through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog: -- **Google Drive MCP** — listed as plain **Google Drive** in your catalog. C1 registers Google's own hosted Drive MCP server (`drivemcp.googleapis.com`) as a downstream server C1 governs. Authentication is per-user OAuth using a Google Cloud OAuth client you create — Google doesn't support dynamic client registration (DCR) for this server, so there's no bearer token or API key fallback either. Tool calls run with the connected user's own Drive permissions, scoped to whichever OAuth scopes you grant. +- **Google Drive MCP** — listed as plain **Google Drive** in your catalog. C1 adds Google's own hosted Drive MCP server (`drivemcp.googleapis.com`) as a Catalog MCP source. Authentication is per-user OAuth using a Google Cloud OAuth client you create — Google doesn't support dynamic client registration (DCR) for this server, so there's no bearer token or API key fallback either. Tool calls run with the connected user's own Drive permissions, scoped to whichever OAuth scopes you grant. - **Google Drive API** — C1 hosts its own MCP server that translates the Google Drive REST API into tools. You choose between per-user OAuth or a service account with domain-wide delegation (Workspace only), and you scope access with the OAuth or delegated scopes you configure. | | Google Drive MCP | Google Drive API | @@ -23,7 +23,7 @@ C1 can govern Google Drive access two ways. Both let your AI clients read from a | **Authentication** | Per-user OAuth with a Google Cloud OAuth client you create — no dynamic client registration, bearer token, or API key option | Per-user OAuth, or a service account with domain-wide delegation (Workspace only) | | **Access scoping** | The connected user's Drive permissions, within the OAuth scopes you grant (`drive`, `drive.readonly`, or `drive.file`) | The OAuth scopes you configure, or the scopes you delegate to the service account | | **Tool surface** | Google's own fixed tool set: search, read and download content, file metadata, permissions, recent files, plus file creation and copying | Files, folders, shared drives, permissions, comments, and revisions, mapped to Drive API endpoints | -| **Setup effort** | Create a Google Cloud OAuth client and enable the Drive MCP API, then register in C1 | Create an OAuth client or service account first, then register in C1 | +| **Setup effort** | Create a Google Cloud OAuth client and enable the Drive MCP API, then add the source in C1 | Create an OAuth client or service account first, then add the source in C1 | Use the native **Google Drive MCP** option (listed as plain **Google Drive** in your catalog) if Google's own tool set covers what you need and per-user OAuth is acceptable for your tenant. Use **Google Drive API** if you need a shared service-account credential, or you want the broader tool surface — including permissions, comments, and revisions — that C1's own translation provides. @@ -36,11 +36,11 @@ C1 registers as a client of Google's own hosted Drive MCP server ([Configure the ## Before you begin - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management). -- A Google Cloud project with an OAuth client — see [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup). This option additionally requires enabling the **Google Drive MCP API** in that project (covered below); the shared guide doesn't cover that API since it's specific to this option. +- A Google Cloud project with an OAuth client — see [Set up a Google Cloud project for MCP sources](/product/admin/mcp-server/google-cloud-project-setup). This option additionally requires enabling the **Google Drive MCP API** in that project (covered below); the shared guide doesn't cover that API since it's specific to this option. - Each user needs a Google account with access to the Drive content you want their AI client to reach. -In your MCP server catalog, this option is listed as **Google Drive** — distinct from the **Google Drive API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Google Drive** — distinct from the **Google Drive API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Set up per-user OAuth @@ -49,11 +49,11 @@ Per-user OAuth with a Google Cloud OAuth client is the only authentication metho ### Create a Google OAuth client -If you already completed [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup) for another Google connector, you can reuse that project and OAuth client — you only need to enable one additional API and add the Drive MCP scopes. +If you already completed [Set up a Google Cloud project for MCP sources](/product/admin/mcp-server/google-cloud-project-setup) for another Google connector, you can reuse that project and OAuth client — you only need to enable one additional API and add the Drive MCP scopes. -Follow [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup) to create or select a project, grant your users the **Service Usage Consumer** role, and create an OAuth client with the redirect URI set to `https://accounts.conductor.one/auth/callback`. +Follow [Set up a Google Cloud project for MCP sources](/product/admin/mcp-server/google-cloud-project-setup) to create or select a project, grant your users the **Service Usage Consumer** role, and create an OAuth client with the redirect URI set to `https://accounts.conductor.one/auth/callback`. In the same project, also enable the **Google Drive MCP API** (`drivemcp.googleapis.com`): go to **APIs & Services** > **Library**, search for **Google Drive MCP API**, and select **Enable**. Google's hosted Drive MCP server requires this API alongside the Google Drive API. See Google's [Enable the MCP services](https://developers.google.com/workspace/drive/api/guides/configure-mcp-server#enable-mcp-services) documentation. @@ -63,13 +63,13 @@ On the OAuth consent screen's **Data Access** page, add the scopes you want to g -### Register the server with OAuth +### Add the source with OAuth -With your OAuth client ready, register the server and provide its credentials. +With your OAuth client ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Drive** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Google Drive** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enter your OAuth client's **client ID**, **client secret**, and the scopes you configured. There's no **Use dynamic client registration** toggle for this server — Google doesn't support it. @@ -89,9 +89,9 @@ This option only supports per-user OAuth — there's no shared, service-account, ## Discover and govern tools -After you register the server, C1 runs tool discovery against Google's Drive MCP server. Discovered tools appear on the server's **Tools** tab and include Google's own search, file content, metadata, permissions, and file creation and copying tools. +After you add the source, C1 runs tool discovery against Google's Drive MCP server. Discovered tools appear on the source's **Tools** tab and include Google's own search, file content, metadata, permissions, and file creation and copying tools. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Google Drive tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -101,7 +101,7 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove ## Manage access to Google Drive MCP -- **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the source's authentication settings in C1. - **Adjust scopes** by editing them on the OAuth consent screen's **Data Access** page; users must reconnect their Google account to grant any newly added scopes. - **An individual user can revoke access at any time** from their Google Account's linked apps page. See Google's [Manage third-party apps & services with access to your account](https://support.google.com/accounts/answer/3466521) documentation. @@ -111,7 +111,7 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove C1 hosts the Google Drive MCP server, so your users' AI clients only ever see MCP tools — they never call Google Drive directly. When an AI client calls one of these tools, C1 makes the matching request to the Google Drive API using the credentials you configure here, then returns the result to the AI client. The credentials you set up below are what C1 uses to call Google Drive on your users' behalf. -Google Drive supports two ways to authenticate, and you choose one when you register the server: +Google Drive supports two ways to authenticate, and you choose one when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own Google account, so every tool call runs under that user's Drive identity and permissions. - **Service account (Workspace only)**. A single Google service account with domain-wide delegation authenticates everyone, so all tool calls reach Drive as one shared identity. @@ -121,11 +121,11 @@ For a deeper comparison of shared versus per-user credentials, see [Configure au ## Before you begin - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management). -- A Google Cloud project, set up as described in [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup). That guide covers enabling the Google Drive API, creating OAuth credentials, and granting your users the **Service Usage Consumer** role on the quota project so their tool calls aren't rejected with `PERMISSION_DENIED`. +- A Google Cloud project, set up as described in [Set up a Google Cloud project for MCP sources](/product/admin/mcp-server/google-cloud-project-setup). That guide covers enabling the Google Drive API, creating OAuth credentials, and granting your users the **Service Usage Consumer** role on the quota project so their tool calls aren't rejected with `PERMISSION_DENIED`. - For the service-account option, a Google Workspace administrator to set up [domain-wide delegation](https://knowledge.workspace.google.com/admin/apps/control-api-access-with-domain-wide-delegation). -In your MCP server catalog, this option is listed as **Google Drive API** — distinct from the **Google Drive** entry, which connects to Google's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Google Drive API** — distinct from the **Google Drive** entry, which connects to Google's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -159,13 +159,13 @@ Select **Create**, then copy the **Client ID** and **Client secret**. Google sho For least privilege, request only the scopes you need. Read-only deployments can use `drive.readonly` and `drive.metadata.readonly`. If your users are on Google Workspace, a Workspace administrator may need to allow the OAuth client in **Admin Console** > **Security** > **Access and data control** > **API controls** > **App access control**. -### Register the server with OAuth +### Add the source with OAuth -With your OAuth client ready, register the server and provide its credentials. +With your OAuth client ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Drive API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Google Drive API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enter your OAuth client's **client ID** and **client secret**, plus the scopes you configured. Also enter the **Google Cloud Quota Project ID** — the ID of the project where you enabled the Google Drive API and granted users the Service Usage Consumer role. @@ -198,13 +198,13 @@ As a Workspace administrator, go to **Admin Console** > **Security** > **Access -### Register the server with a service account +### Add the source with a service account -With your service account ready, register the server and provide its key. +With your service account ready, add the source and provide its key. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Google Drive API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Google Drive API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **JWT Bearer (RFC 7523)** and provide the service account's JSON key and the scopes you delegated. @@ -221,13 +221,13 @@ How Google Drive sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Google account, so tool calls run under that user's Drive identity and inherit only the access they already have. Google attributes each action to the individual user. - **Service account.** Every user's tool calls use the one service account you configured, so Drive sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Google Drive. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Google Drive. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Google Drive tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -237,7 +237,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Google Drive API credentials -- **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your Google Cloud project under **APIs & Services** > **Credentials**, then update the secret on the source's authentication settings in C1. - **Rotate the service account key** by generating a new JSON key in the Cloud Console, updating it in C1, then deleting the old key. - **Adjust access** by editing the OAuth client's scopes, or the scopes granted to the service account in domain-wide delegation. diff --git a/product/admin/mcp-server/granola.mdx b/product/admin/mcp-server/granola.mdx index 95eee5ea..cac1c6c7 100644 --- a/product/admin/mcp-server/granola.mdx +++ b/product/admin/mcp-server/granola.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Granola MCP server -description: Connect Granola to C1 through Granola's own hosted MCP server or the Granola API, then register the server and govern its tools. -og:title: Set up the Granola MCP server -og:description: Connect Granola to C1 through Granola's own hosted MCP server or the Granola API, then register the server and govern its tools. +title: Set up the Granola MCP source +description: Connect Granola to C1 through Granola's own hosted MCP server or the Granola API, then add the Catalog MCP source and govern its tools. +og:title: Set up the Granola MCP source +og:description: Connect Granola to C1 through Granola's own hosted MCP server or the Granola API, then add the Catalog MCP source and govern its tools. sidebarTitle: Granola --- @@ -12,9 +12,9 @@ sidebarTitle: Granola **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern [Granola](https://www.granola.ai) — an AI meeting-notes app — access two ways. Both let your AI clients read from Granola through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: +C1 can govern [Granola](https://www.granola.ai) — an AI meeting-notes app — access two ways. Both let your AI clients read from Granola through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog: -- **Granola MCP** — listed as plain **Granola** in your catalog. C1 registers Granola's own hosted MCP server (`mcp.granola.ai`) as a downstream server C1 governs. Authentication is always per-user OAuth using dynamic client registration (DCR) — Granola's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in Granola first. Tool calls run with the connected user's own Granola access, scoped to their active workspace. +- **Granola MCP** — listed as plain **Granola** in your catalog. C1 adds Granola's own hosted MCP server (`mcp.granola.ai`) as a Catalog MCP source. Authentication is always per-user OAuth using dynamic client registration (DCR) — Granola's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in Granola first. Tool calls run with the connected user's own Granola access, scoped to their active workspace. - **Granola API** — C1 hosts its own MCP server that translates Granola's REST API into tools. Authentication is a single shared bearer token (a Granola API key), so every tool call reaches Granola as one identity. | | Granola MCP | Granola API | @@ -23,7 +23,7 @@ C1 can govern [Granola](https://www.granola.ai) — an AI meeting-notes app — | **Authentication** | Per-user OAuth with dynamic client registration (DCR) only — no bearer token or API key option | Bearer token (a Granola API key) only — no OAuth option | | **Access scoping** | The connected user's own Granola access, for their active workspace | Whatever notes the API key's access scope (personal and/or public notes) covers | | **Tool surface** | Granola's own meeting-notes tools: searching meeting history, browsing folders, listing meetings, and reading full notes | Granola's meeting-data REST endpoints, mapped to tools | -| **Setup effort** | Register in C1 and authorize — nothing to create in Granola first | Generate a Granola API key first, then register it in C1 | +| **Setup effort** | Add the source in C1 and authorize — nothing to create in Granola first | Generate a Granola API key first, then add the source in C1 | Use the native **Granola MCP** option (listed as plain **Granola** in your catalog) if per-user OAuth is acceptable for your tenant and you want each user's tool calls attributed to them individually. Use **Granola API** if you need a single shared credential instead. @@ -39,7 +39,7 @@ C1 registers as a client of Granola's own hosted MCP server ([Granola MCP](https - Nothing to create in Granola ahead of time. This option only supports per-user OAuth with dynamic client registration — Granola's hosted MCP server doesn't offer a bearer token or API key mode, so there's no client ID, secret, or integration to register. Each user just needs a Granola account with access to the workspace whose notes they want tools to reach. -In your MCP server catalog, this option is listed as **Granola** — distinct from the **Granola API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Granola** — distinct from the **Granola API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Set up per-user OAuth @@ -48,7 +48,7 @@ Per-user OAuth with dynamic client registration (DCR) is the only authentication -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Granola** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Granola** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enable **Use dynamic client registration**. There's no client ID or secret to enter. @@ -68,9 +68,9 @@ This option only supports per-user OAuth — there's no shared, service-account, ## Discover and govern tools -After you register the server, C1 runs tool discovery against Granola's MCP server. Discovered tools appear on the server's **Tools** tab and include Granola's meeting-notes search, folder browsing, meeting listing, and note-reading tools. +After you add the source, C1 runs tool discovery against Granola's MCP server. Discovered tools appear on the source's **Tools** tab and include Granola's meeting-notes search, folder browsing, meeting listing, and note-reading tools. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Granola tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -96,12 +96,12 @@ Granola supports one authentication method for its API: a bearer token (a Granol - You need access to generate a Granola API key. On Granola's Business plan, any workspace member can create a personal API key; on Granola's Enterprise plan, a workspace admin must first enable API key access for members before a key can be created. See Granola's [API documentation](https://docs.granola.ai/introduction#api-key-access-scopes). -In your MCP server catalog, this option is listed as **Granola API** — distinct from the **Granola** entry, which connects to Granola's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Granola API** — distinct from the **Granola** entry, which connects to Granola's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Generate a Granola API key -Generate the key in the Granola app before registering the server in C1. +Generate the key in the Granola app before adding the source in C1. @@ -117,11 +117,11 @@ Select **Generate API Key**, then copy the key. Treat it as a high-value credent For a shared production setup, generate the key from a dedicated service-account workspace member so activity is attributable to C1 rather than a person. -With your API key ready, register the server and provide it to C1: +With your API key ready, add the source and provide it to C1: -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Granola API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Granola API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your Granola API key. @@ -135,13 +135,13 @@ Save your changes. C1 starts a sync that discovers the tools the Granola API exp Every user's tool calls use the one API key you provided, so Granola sees a single shared identity for all activity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Granola. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Granola. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Granola tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -151,7 +151,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Granola API credentials -- **Rotate the API key** by generating a new key in Granola (**Settings** > **Connectors** > **API keys**) and updating it on the server's authentication settings in C1. +- **Rotate the API key** by generating a new key in Granola (**Settings** > **Connectors** > **API keys**) and updating it on the source's authentication settings in C1. - **Revoke a key** from the same page in Granola. Once revoked, a key is permanently disabled and cannot be restored — generate a new one and update it in C1 to keep the integration working. - **Adjust access** by generating a new key with a different note access scope, since a key's scope is set when it's created. diff --git a/product/admin/mcp-server/hubspot.mdx b/product/admin/mcp-server/hubspot.mdx index f641593f..dc1b0674 100644 --- a/product/admin/mcp-server/hubspot.mdx +++ b/product/admin/mcp-server/hubspot.mdx @@ -1,8 +1,8 @@ --- -title: Set up the HubSpot MCP server -description: Create a HubSpot private app token and register the HubSpot MCP server in C1 so AI clients can call governed HubSpot tools. -og:title: Set up the HubSpot MCP server -og:description: Create a HubSpot private app token and register the HubSpot MCP server in C1 so AI clients can call governed HubSpot tools. +title: Set up the HubSpot MCP source +description: Create a HubSpot private app token and add HubSpot as a Catalog MCP source in C1 so AI clients can call governed HubSpot tools. +og:title: Set up the HubSpot MCP source +og:description: Create a HubSpot private app token and add HubSpot as a Catalog MCP source in C1 so AI clients can call governed HubSpot tools. sidebarTitle: HubSpot --- @@ -12,7 +12,7 @@ sidebarTitle: HubSpot **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The HubSpot MCP server lets you govern access to HubSpot — contacts, companies, deals, and other CRM records — as tools your AI clients can call through C1. +The HubSpot Catalog MCP source lets you govern access to HubSpot — contacts, companies, deals, and other CRM records — as tools your AI clients can call through C1. HubSpot authenticates with a private app access token. A single token authenticates everyone, so all tool calls reach HubSpot as one shared identity. Create the token from a dedicated service-account user so activity is attributable to C1 rather than a person. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call HubSpot on your users' - A HubSpot account with permission to create and manage private apps, which requires super admin access. -If you don't see **HubSpot** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **HubSpot** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a HubSpot private app token @@ -54,15 +54,15 @@ Select **Create app**, then copy the **access token**. Treat the token like a pa Every user's tool calls use the one private app token you provided, so HubSpot sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared production setup, create the token from a dedicated service-account user so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the HubSpot MCP server in C1 +## Add the HubSpot Catalog MCP source in C1 -With your token ready, register the server and provide your credentials. +With your token ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **HubSpot** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **HubSpot** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your private app access token. @@ -74,9 +74,9 @@ Save your changes. C1 starts a sync that discovers the tools the HubSpot server ## Discover and govern tools -After you register the server, C1 runs tool discovery against HubSpot. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against HubSpot. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a HubSpot tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -86,5 +86,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your HubSpot credentials -- **Rotate the access token** by rotating it in the private app's settings in HubSpot, then update the token on the server's authentication settings in C1. +- **Rotate the access token** by rotating it in the private app's settings in HubSpot, then update the token on the source's authentication settings in C1. - **Adjust access** by editing the private app's scopes in HubSpot. diff --git a/product/admin/mcp-server/jira-service-management.mdx b/product/admin/mcp-server/jira-service-management.mdx index c5859aee..eb159bfe 100644 --- a/product/admin/mcp-server/jira-service-management.mdx +++ b/product/admin/mcp-server/jira-service-management.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Jira Service Management MCP server -description: Connect Jira Service Management to C1 with per-user OAuth, then register the MCP server and govern the tools it exposes. -og:title: Set up the Jira Service Management MCP server -og:description: Connect Jira Service Management to C1 with per-user OAuth, then register the MCP server and govern the tools it exposes. +title: Set up the Jira Service Management MCP source +description: Connect Jira Service Management to C1 with per-user OAuth, then add the Catalog MCP source and govern the tools it exposes. +og:title: Set up the Jira Service Management MCP source +og:description: Connect Jira Service Management to C1 with per-user OAuth, then add the Catalog MCP source and govern the tools it exposes. sidebarTitle: Jira Service Management --- @@ -12,7 +12,7 @@ sidebarTitle: Jira Service Management **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Jira Service Management MCP server lets you govern access to Jira Service Management — service desks, requests, queues, customers, organizations, knowledge base content, and SLAs — as tools your AI clients can call through C1. +The Jira Service Management Catalog MCP source lets you govern access to Jira Service Management — service desks, requests, queues, customers, organizations, knowledge base content, and SLAs — as tools your AI clients can call through C1. Jira Service Management uses per-user OAuth, which is recommended: each person authorizes with their own Atlassian account, so every tool call runs under that user's identity and permissions. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Jira Service Managemen - An Atlassian account that can create an OAuth 2.0 integration. See Atlassian's [OAuth 2.0 (3LO) apps guide](https://developer.atlassian.com/cloud/jira/service-desk/oauth-2-authorization-code-grants-3lo-for-apps/). -If you don't see **Jira Service Management** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Jira Service Management** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create an Atlassian OAuth 2.0 integration @@ -63,15 +63,15 @@ Open the **Settings** tab. Under **Authentication details**, copy the **Client I With per-user OAuth, each user authorizes with their own Atlassian account, so tool calls run under that user's Jira Service Management identity and inherit only the access they already have. Atlassian attributes each action to the individual user. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Jira Service Management MCP server in C1 +## Add the Jira Service Management Catalog MCP source in C1 -With your integration ready, register the server and provide your credentials. +With your integration ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Jira Service Management** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Jira Service Management** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your integration's **client ID** and **client secret**. @@ -83,9 +83,9 @@ Save your changes. The first time a user calls a Jira Service Management tool fr ## Discover and govern tools -After you register the server, C1 runs tool discovery against Jira Service Management. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Jira Service Management. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Jira Service Management tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -95,5 +95,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Jira Service Management credentials -- **Rotate the OAuth client secret** in the Atlassian Developer Console under your integration's **Settings** tab, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in the Atlassian Developer Console under your integration's **Settings** tab, then update the secret on the source's authentication settings in C1. - **Adjust access** by editing the integration's scopes on the **Permissions** tab in the Atlassian Developer Console. diff --git a/product/admin/mcp-server/jira.mdx b/product/admin/mcp-server/jira.mdx index 5ae68db2..4d1d9114 100644 --- a/product/admin/mcp-server/jira.mdx +++ b/product/admin/mcp-server/jira.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Jira MCP server -description: Connect Jira to C1 with per-user OAuth, then register the Jira MCP server and govern the tools it exposes. -og:title: Set up the Jira MCP server -og:description: Connect Jira to C1 with per-user OAuth, then register the Jira MCP server and govern the tools it exposes. +title: Set up the Jira MCP source +description: Connect Jira to C1 with per-user OAuth, then add Jira as a Catalog MCP source and govern the tools it exposes. +og:title: Set up the Jira MCP source +og:description: Connect Jira to C1 with per-user OAuth, then add Jira as a Catalog MCP source and govern the tools it exposes. sidebarTitle: Jira --- @@ -12,7 +12,7 @@ sidebarTitle: Jira **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Jira MCP server lets you govern access to Jira Cloud — issues, projects, sprints, workflows, dashboards, filters, fields, and configuration — as tools your AI clients can call through C1. +The Jira Catalog MCP source lets you govern access to Jira Cloud — issues, projects, sprints, workflows, dashboards, filters, fields, and configuration — as tools your AI clients can call through C1. Jira uses per-user OAuth, which is recommended: each person authorizes with their own Atlassian account, so every tool call runs under that user's identity and permissions. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Jira on your users' be - An Atlassian account that can create an OAuth 2.0 integration. See Atlassian's [OAuth 2.0 (3LO) apps guide](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/). -If you don't see **Jira** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Jira** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create an Atlassian OAuth 2.0 integration @@ -84,15 +84,15 @@ Atlassian recommends keeping an app under 50 scopes and using classic scopes whe With per-user OAuth, each user authorizes with their own Atlassian account, so tool calls run under that user's Jira identity and inherit only the access they already have. Atlassian attributes each action to the individual user. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Jira MCP server in C1 +## Add the Jira Catalog MCP source in C1 -With your integration ready, register the server and provide your credentials. +With your integration ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Jira** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Jira** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your integration's **client ID** and **client secret**. @@ -104,9 +104,9 @@ Save your changes. The first time a user calls a Jira tool from their AI client, ## Discover and govern tools -After you register the server, C1 runs tool discovery against Jira. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Jira. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Jira tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -116,5 +116,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Jira credentials -- **Rotate the OAuth client secret** in the Atlassian Developer Console under your integration's **Settings** tab, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in the Atlassian Developer Console under your integration's **Settings** tab, then update the secret on the source's authentication settings in C1. - **Adjust access** by editing the integration's Jira scopes on the **Permissions** tab in the Atlassian Developer Console. diff --git a/product/admin/mcp-server/linear.mdx b/product/admin/mcp-server/linear.mdx index f8b1edd3..99dc7195 100644 --- a/product/admin/mcp-server/linear.mdx +++ b/product/admin/mcp-server/linear.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Linear MCP server -description: Connect Linear to C1 through Linear's own hosted MCP server or the Linear API, then register the server and govern its tools. -og:title: Set up the Linear MCP server -og:description: Connect Linear to C1 through Linear's own hosted MCP server or the Linear API, then register the server and govern its tools. +title: Set up the Linear MCP source +description: Connect Linear to C1 through Linear's own hosted MCP server or the Linear API, then add the Catalog MCP source and govern its tools. +og:title: Set up the Linear MCP source +og:description: Connect Linear to C1 through Linear's own hosted MCP server or the Linear API, then add the Catalog MCP source and govern its tools. sidebarTitle: Linear --- @@ -12,9 +12,9 @@ sidebarTitle: Linear **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern Linear access two ways. Both let your AI clients read from and act on Linear through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: +C1 can govern Linear access two ways. Both let your AI clients read from and act on Linear through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog: -- **Linear MCP** — listed as plain **Linear** in your catalog. C1 registers Linear's own hosted MCP server (`mcp.linear.app`) as a downstream server C1 governs. The recommended authentication method is per-user OAuth with dynamic client registration (DCR) — nothing to register in Linear first. Linear's MCP server also accepts a personal API key sent as a bearer token, if you'd rather use a single shared credential. +- **Linear MCP** — listed as plain **Linear** in your catalog. C1 adds Linear's own hosted MCP server (`mcp.linear.app`) as a Catalog MCP source. The recommended authentication method is per-user OAuth with dynamic client registration (DCR) — nothing to register in Linear first. Linear's MCP server also accepts a personal API key sent as a bearer token, if you'd rather use a single shared credential. - **Linear API** — C1 hosts its own MCP server that translates the Linear API into tools. You choose between per-user OAuth (which requires creating a Linear OAuth application) or a personal API key, and scope access with the OAuth scopes or API key permissions you grant. | | Linear MCP | Linear API | @@ -23,7 +23,7 @@ C1 can govern Linear access two ways. Both let your AI clients read from and act | **Authentication** | Per-user OAuth with dynamic client registration (DCR), or a personal API key (bearer token) | Per-user OAuth (requires a Linear OAuth application), or a personal API key (bearer token) | | **Access scoping** | The connected user's full Linear permissions with OAuth; a personal API key can be restricted to Read, Write, Admin, Create issues, Create comments, and specific teams | The OAuth scopes or API key permissions you configure | | **Tool surface** | Linear's own tool set: finding, creating, and updating issues, projects, and comments, with more functionality on the way | Issues, projects, cycles, teams, users, and comments, mapped to Linear API endpoints | -| **Setup effort** | Register in C1 and authorize — nothing to create in Linear first for OAuth | Create a Linear OAuth application first (for per-user OAuth), then register it in C1 | +| **Setup effort** | Add the source in C1 and authorize — nothing to create in Linear first for OAuth | Create a Linear OAuth application first (for per-user OAuth), then add the source in C1 | Use the native **Linear MCP** option (listed as plain **Linear** in your catalog) if you want Linear's own hosted tool set and dynamic client registration is acceptable for your tenant. Use **Linear API** if you need to create a dedicated OAuth application, or you want to scope access with the Linear API's own permission model. @@ -40,7 +40,7 @@ C1 registers as a client of Linear's own hosted MCP server ([MCP server](https:/ - For a personal API key, you need the Linear account whose access the key should carry. -In your MCP server catalog, this option is listed as **Linear** — distinct from the **Linear API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Linear** — distinct from the **Linear API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. Linear's MCP server (`https://mcp.linear.app/mcp`) supports two ways to authenticate: @@ -54,7 +54,7 @@ Linear's MCP server supports OAuth 2.1 with dynamic client registration ([MCP se -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Linear** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Linear** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enable **Use dynamic client registration**. There's no client ID or secret to enter. @@ -70,7 +70,7 @@ Linear's MCP server also accepts a personal API key sent as a bearer credential ### Create a personal API key -Create the key in Linear before registering the server in C1. +Create the key in Linear before adding the source in C1. @@ -89,13 +89,13 @@ Copy the generated key. For a read-only connection, restrict the key to the **Read** permission only. For a shared production setup, create the key from a dedicated service-account user so activity is attributable to C1 rather than a person. -### Register the server with a key +### Add the source with a key -With your key ready, register the server and provide it as the credential. +With your key ready, add the source and provide it as the credential. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Linear** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Linear** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your personal API key. @@ -116,9 +116,9 @@ With per-user OAuth, tool calls run with the connected user's own Linear permiss ## Discover and govern tools -After you register the server, C1 runs tool discovery against Linear's MCP server. Discovered tools appear on the server's **Tools** tab and include Linear's own tools for finding, creating, and updating issues, projects, and comments. +After you add the source, C1 runs tool discovery against Linear's MCP server. Discovered tools appear on the source's **Tools** tab and include Linear's own tools for finding, creating, and updating issues, projects, and comments. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Linear tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -135,9 +135,9 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove -The Linear MCP server lets you govern access to Linear — issues, projects, cycles, teams, users, and comments — as tools your AI clients can call through C1. +The Linear Catalog MCP source lets you govern access to Linear — issues, projects, cycles, teams, users, and comments — as tools your AI clients can call through C1. -Linear supports two ways to authenticate, and you choose one when you register the server: +Linear supports two ways to authenticate, and you choose one when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own Linear account, so every tool call runs under that user's Linear identity and permissions. - **Personal API key**. A single key authenticates everyone, so all tool calls reach Linear as one shared identity. @@ -157,7 +157,7 @@ The credentials you set up below are what C1 uses to call Linear on your users' - For a personal API key, you need the Linear account whose access the key should carry. -If you don't see **Linear API** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Linear API** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -187,13 +187,13 @@ Save the application, then copy its **Client ID** and **Client Secret**. -### Register the server with OAuth +### Add the source with OAuth -With your OAuth application ready, register the server and provide its credentials. +With your OAuth application ready, add the source and provide its credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Linear API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Linear API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your application's **client ID** and **client secret**. @@ -228,13 +228,13 @@ Copy the key immediately. Linear shows it only once. For a shared production setup, create the key from a dedicated service-account user with only the workspace memberships C1 needs, so activity is attributable to C1 rather than a person. -### Register the server with a key +### Add the source with a key -With your key ready, register the server and provide it as the credential. +With your key ready, add the source and provide it as the credential. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Linear API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Linear API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your personal API key. @@ -251,13 +251,13 @@ How Linear sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Linear account, so tool calls run under that user's Linear identity and inherit only the access they already have. Linear attributes each action to the individual user. - **Personal API key.** Every user's tool calls use the one key you provided, so Linear sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Linear. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Linear. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Linear tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -267,7 +267,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Linear API credentials -- **Rotate the OAuth client secret** in your Linear OAuth application under **Settings** > **API** > **OAuth applications**, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your Linear OAuth application under **Settings** > **API** > **OAuth applications**, then update the secret on the source's authentication settings in C1. - **Rotate a personal API key** in **Settings** > **Security & access** by deleting the existing key, creating a new one, and updating it in C1. Linear personal API keys don't expire on their own, so rotate them on a schedule. - **Adjust access** by editing the OAuth application's scopes, or by changing the workspace memberships of the account that owns the personal API key. diff --git a/product/admin/mcp-server/linkedin.mdx b/product/admin/mcp-server/linkedin.mdx index b3958492..f2528e3d 100644 --- a/product/admin/mcp-server/linkedin.mdx +++ b/product/admin/mcp-server/linkedin.mdx @@ -1,8 +1,8 @@ --- -title: Set up the LinkedIn MCP server -description: Connect LinkedIn to C1 with per-user OAuth, then register the LinkedIn MCP server and govern its tools. -og:title: Set up the LinkedIn MCP server -og:description: Connect LinkedIn to C1 with per-user OAuth, then register the LinkedIn MCP server and govern its tools. +title: Set up the LinkedIn MCP source +description: Connect LinkedIn to C1 with per-user OAuth, then add LinkedIn as a Catalog MCP source and govern its tools. +og:title: Set up the LinkedIn MCP source +og:description: Connect LinkedIn to C1 with per-user OAuth, then add LinkedIn as a Catalog MCP source and govern its tools. sidebarTitle: LinkedIn --- @@ -12,7 +12,7 @@ sidebarTitle: LinkedIn **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The LinkedIn MCP server lets you govern access to LinkedIn — member profiles, organization pages, social posts, and ads data — as tools your AI clients can call through C1. +The LinkedIn Catalog MCP source lets you govern access to LinkedIn — member profiles, organization pages, social posts, and ads data — as tools your AI clients can call through C1. LinkedIn authenticates with per-user OAuth. Each person authorizes with their own LinkedIn account, so every tool call runs under that user's LinkedIn identity and permissions. For a deeper comparison of shared versus per-user credentials, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call LinkedIn on your users - A LinkedIn account with permission to create an app in the LinkedIn Developer Portal, linked to a LinkedIn Page you administer. -If you don't see **LinkedIn** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **LinkedIn** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a LinkedIn app @@ -57,15 +57,15 @@ Copy the **client ID** and **client secret** from the **Auth** tab. Each user authorizes with their own LinkedIn account, so tool calls run under that user's LinkedIn identity and inherit only the access they already have. LinkedIn attributes each action to the individual user. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the LinkedIn MCP server in C1 +## Add the LinkedIn Catalog MCP source in C1 -With your app ready, register the server and provide your credentials. +With your app ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **LinkedIn** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **LinkedIn** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your app's **client ID** and **client secret**. @@ -77,9 +77,9 @@ Save your changes. The first time a user calls a LinkedIn tool from their AI cli ## Discover and govern tools -After you register the server, C1 runs tool discovery against LinkedIn. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against LinkedIn. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a LinkedIn tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -89,5 +89,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your LinkedIn credentials -- **Rotate the client secret** in your LinkedIn app under the **Auth** tab, then update the secret on the server's authentication settings in C1. +- **Rotate the client secret** in your LinkedIn app under the **Auth** tab, then update the secret on the source's authentication settings in C1. - **Adjust access** by requesting or removing products on the app's **Products** tab in LinkedIn. diff --git a/product/admin/mcp-server/looker.mdx b/product/admin/mcp-server/looker.mdx index 8f51a46c..04e64778 100644 --- a/product/admin/mcp-server/looker.mdx +++ b/product/admin/mcp-server/looker.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Looker MCP server -description: Create Looker API credentials, then register the Looker MCP server in C1 and govern the tools it exposes. -og:title: Set up the Looker MCP server -og:description: Create Looker API credentials, then register the Looker MCP server in C1 and govern the tools it exposes. +title: Set up the Looker MCP source +description: Create Looker API credentials, then add Looker as a Catalog MCP source in C1 and govern the tools it exposes. +og:title: Set up the Looker MCP source +og:description: Create Looker API credentials, then add Looker as a Catalog MCP source in C1 and govern the tools it exposes. sidebarTitle: Looker --- @@ -12,7 +12,7 @@ sidebarTitle: Looker **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Looker MCP server lets you govern access to Looker — dashboards, looks, queries, explores, content, and users — as tools your AI clients can call through C1. +The Looker Catalog MCP source lets you govern access to Looker — dashboards, looks, queries, explores, content, and users — as tools your AI clients can call through C1. Looker authenticates with API credentials: a client ID and client secret that C1 exchanges for a short-lived access token. A single set of credentials authenticates everyone, so all tool calls reach Looker as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Looker on your users' - A Looker account with API credentials. API credentials inherit the permissions and content access of the user they belong to, so use a user that has the access you want this integration to have. -If you don't see **Looker** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Looker** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create Looker API credentials @@ -53,15 +53,15 @@ For a shared production setup, create the credentials under a dedicated service- Every user's tool calls use the one set of API credentials you provided, so Looker sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, create the credentials under a dedicated service-account user so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Looker MCP server in C1 +## Add the Looker Catalog MCP source in C1 -With your credentials ready, register the server and provide them to C1. +With your credentials ready, add the source and provide them to C1. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Looker** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Looker** from the catalog. Enter your Looker instance URL when prompted. @@ -76,9 +76,9 @@ Save your changes. C1 starts a sync that discovers the tools the Looker server e ## Discover and govern tools -After you register the server, C1 runs tool discovery against Looker. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Looker. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Looker tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/lucid.mdx b/product/admin/mcp-server/lucid.mdx index f5092893..f2c6d29d 100644 --- a/product/admin/mcp-server/lucid.mdx +++ b/product/admin/mcp-server/lucid.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Lucid MCP server -description: Connect Lucid to C1 through the Lucid API or Lucid's own hosted MCP server, then register the server and govern its tools. -og:title: Set up the Lucid MCP server -og:description: Connect Lucid to C1 through the Lucid API or Lucid's own hosted MCP server, then register the server and govern its tools. +title: Set up the Lucid MCP source +description: Connect Lucid to C1 through the Lucid API or Lucid's own hosted MCP server, then add the Catalog MCP source and govern its tools. +og:title: Set up the Lucid MCP source +og:description: Connect Lucid to C1 through the Lucid API or Lucid's own hosted MCP server, then add the Catalog MCP source and govern its tools. sidebarTitle: Lucid --- @@ -12,9 +12,9 @@ sidebarTitle: Lucid **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern Lucid access two ways. Both let your AI clients read from and act on Lucid through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: +C1 can govern Lucid access two ways. Both let your AI clients read from and act on Lucid through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog: -- **Lucid MCP** — listed as plain **Lucid** in your catalog. C1 registers Lucid's own hosted MCP server (`mcp.lucid.app`) as a downstream server C1 governs. Authentication is always per-user OAuth using dynamic client registration (DCR) — Lucid's hosted MCP server doesn't support a bearer token or API key, so there's no application to create in Lucid first. Before anyone can connect, a Lucid account admin must enable MCP access for the account from the Lucid Admin Panel. Tool calls run with the connected user's full Lucid permissions. +- **Lucid MCP** — listed as plain **Lucid** in your catalog. C1 adds Lucid's own hosted MCP server (`mcp.lucid.app`) as a Catalog MCP source. Authentication is always per-user OAuth using dynamic client registration (DCR) — Lucid's hosted MCP server doesn't support a bearer token or API key, so there's no application to create in Lucid first. Before anyone can connect, a Lucid account admin must enable MCP access for the account from the Lucid Admin Panel. Tool calls run with the connected user's full Lucid permissions. - **Lucid API** — C1 hosts its own MCP server that translates Lucid's REST API into tools. You choose between per-user OAuth or a shared API token, and you scope access with the **scopes** you grant the Lucid OAuth application (or token). | | Lucid MCP | Lucid API | @@ -23,7 +23,7 @@ C1 can govern Lucid access two ways. Both let your AI clients read from and act | **Authentication** | Per-user OAuth with dynamic client registration (DCR) only — no bearer token or API key option | Per-user OAuth, or a shared API token | | **Access scoping** | The connected user's full Lucid permissions — not independently scoped | The OAuth **scopes** you configure on the application, or the token | | **Tool surface** | Lucid's own tool set: document search, content retrieval, diagram creation (including org charts, mind maps, and UML sequence diagrams), image export, and sharing | Documents, folders, teams, and users, mapped to Lucid API endpoints | -| **Setup effort** | An account admin enables MCP access in Lucid, then register and authorize in C1 — nothing else to create in Lucid first | Create a Lucid OAuth application or API token first, then register it in C1 | +| **Setup effort** | An account admin enables MCP access in Lucid, then adds the source in C1 and authorizes — nothing else to create in Lucid first | Create a Lucid OAuth application or API token first, then add the source in C1 | Use the native **Lucid MCP** option (listed as plain **Lucid** in your catalog) if you want Lucid's own broader, agentic tool set and per-user OAuth is acceptable for your tenant. Use **Lucid API** if you need a shared service-account credential (API token), or you want to scope access with OAuth scopes. @@ -40,7 +40,7 @@ C1 registers as a client of Lucid's own hosted MCP server ([Integrate Lucid with - Nothing else to create in Lucid ahead of time. This option only supports per-user OAuth with dynamic client registration — Lucid's hosted MCP server doesn't offer a bearer token or API key mode, so there's no client ID, secret, or application to register. Each user just needs a Lucid account with access to the workspace. -In your MCP server catalog, this option is listed as **Lucid** — distinct from the **Lucid API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Lucid** — distinct from the **Lucid API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Set up per-user OAuth @@ -52,7 +52,7 @@ Per-user OAuth with dynamic client registration (DCR) is the only authentication In Lucid, have an account admin go to the Lucid Admin Panel and enable MCP access for the account. This is a prerequisite — until it's enabled, users can't connect regardless of how the server is configured in C1. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Lucid** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Lucid** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enable **Use dynamic client registration**. There's no client ID or secret to enter. @@ -72,9 +72,9 @@ This option only supports per-user OAuth — there's no shared, service-account, ## Discover and govern tools -After you register the server, C1 runs tool discovery against Lucid's MCP server. Discovered tools appear on the server's **Tools** tab and include Lucid's own document search and fetch tools, diagram creation (including org charts, mind maps, and UML sequence diagrams), image export, and sharing. +After you add the source, C1 runs tool discovery against Lucid's MCP server. Discovered tools appear on the source's **Tools** tab and include Lucid's own document search and fetch tools, diagram creation (including org charts, mind maps, and UML sequence diagrams), image export, and sharing. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Lucid tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -93,9 +93,9 @@ Because this option uses per-user OAuth, there's no shared secret in C1 to rotat -The Lucid MCP server lets you govern access to Lucid — documents, folders, teams, users, and account data — as tools your AI clients can call through C1. +The Lucid Catalog MCP source lets you govern access to Lucid — documents, folders, teams, users, and account data — as tools your AI clients can call through C1. -Lucid supports two ways to authenticate, and you choose one when you register the server: +Lucid supports two ways to authenticate, and you choose one when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own Lucid account, so every tool call runs under that user's Lucid identity and permissions. - **API token**. A single token authenticates everyone, so all tool calls reach Lucid as one shared identity. @@ -115,7 +115,7 @@ The credentials you set up below are what C1 uses to call Lucid on your users' b - For an API token, the Lucid account whose access the token should carry. -In your MCP server catalog, this option is listed as **Lucid API** — distinct from the **Lucid** entry, which connects to Lucid's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Lucid API** — distinct from the **Lucid** entry, which connects to Lucid's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -141,13 +141,13 @@ Save the application, then copy the **Client ID** and **Client Secret**. Lucid s -### Register the server with OAuth +### Add the source with OAuth -With your OAuth application ready, register the server and provide its credentials to C1. +With your OAuth application ready, add the source and provide its credentials to C1. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Lucid API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Lucid API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your OAuth application's **client ID**, **client secret**, and **scopes**. @@ -179,13 +179,13 @@ Copy the token. Lucid shows the token only once. For a shared production setup, create the token from a dedicated service-account user so activity is attributable to C1 rather than a person. -### Register the server with a token +### Add the source with a token -With your API token ready, register the server and provide it to C1. +With your API token ready, add the source and provide it to C1. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Lucid API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Lucid API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your API token. @@ -202,13 +202,13 @@ How Lucid sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Lucid account, so tool calls run under that user's Lucid identity and inherit only the access they already have. Lucid attributes each action to the individual user. - **API token.** Every user's tool calls use the one token you provided, so Lucid sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Lucid. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Lucid. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Lucid tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -218,7 +218,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Lucid credentials -- **Rotate the OAuth client secret** in your Lucid OAuth application under **Account settings** > **Developer**, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your Lucid OAuth application under **Account settings** > **Developer**, then update the secret on the source's authentication settings in C1. - **Rotate an API token** by generating a new one in Lucid and updating it in C1, then revoking the old token. - **Adjust access** by editing the application's scopes in Lucid. diff --git a/product/admin/mcp-server/mcp-bridge.mdx b/product/admin/mcp-server/mcp-bridge.mdx index 6eea7018..3ccdf36c 100644 --- a/product/admin/mcp-server/mcp-bridge.mdx +++ b/product/admin/mcp-server/mcp-bridge.mdx @@ -1,8 +1,8 @@ --- -title: Connect a private MCP server through a bridge -description: Route AI tool calls to an MCP server running in your private network — no inbound firewall rules needed. -og:title: Connect a private MCP server through a bridge - C1 docs -og:description: Route AI tool calls to an MCP server running in your private network — no inbound firewall rules needed. +title: Connect a private MCP server as an External MCP source +description: Add an MCP server running in your private network as an External MCP source — no inbound firewall rules needed. +og:title: Connect a private MCP server as an External MCP source - C1 docs +og:description: Add an MCP server running in your private network as an External MCP source — no inbound firewall rules needed. sidebarTitle: Private bridge --- @@ -17,14 +17,14 @@ If your MCP server runs in a private network — a laptop, a VM, or a cluster Setup has two halves that must match each other: 1. A **bridge config** (YAML) that tells `bridge-client` where your MCP servers are and what to advertise to C1. -2. An **MCP server registration** in C1, one per advertised service, that points C1 at that service over the bridge. +2. An **External MCP source** in C1, one per advertised service, that points C1 at that service over the bridge. ## Before you begin - Your MCP server must be running and reachable from wherever you'll run `bridge-client`. Have its `host:port`, endpoint path (typically `/mcp`), and transport (`streamable-http` or `sse`) ready. - Download `bridge-client` from the [C1 download center](https://dist.conductorone.com/ConductorOne/bridge-client). Linux and macOS binaries and container images are available there. - **Creating a bridge** requires the **Connector Administrator** or **Super Administrator** role. -- **Registering the MCP server** requires the **Editor** role on the destination app. +- **Adding the External MCP source** requires the **Editor** role on the destination app. ## Step 1: Create a bridge in C1 @@ -75,13 +75,13 @@ bridge: | :--- | :--- | :--- | | `listen_port` | Yes | Port advertised on the bridge (1–65535). Must be unique within the config. | | `backend` | Yes | Local `host:port` that `bridge-client` dials — where your MCP server listens. | -| `name` | Recommended | Service name shown in C1. You select this name when registering the MCP server. Must be unique within the config. | +| `name` | Recommended | Service name shown in C1. You select this name when adding the External MCP source. Must be unique within the config. | | `service_type` | No | `MCP_NATIVE` (native MCP server), `HOSTED` (hosted HTTP MCP), or `RAW` (opaque TCP). | | `service_path` | No | The MCP endpoint path, for example `/mcp`. | | `transport_type` | No | `streamable-http` or `sse` for an MCP server, or `http` for a hosted HTTP service. | -The `service_path` and `transport_type` you set here are what C1 uses when routing tool calls. The registration wizard in Step 4 doesn't let you override them, so set them correctly now. +The `service_path` and `transport_type` you set here are what C1 uses when routing tool calls. The source setup wizard in Step 4 doesn't let you override them, so set them correctly now. ### Expose multiple MCP servers on one bridge @@ -108,7 +108,7 @@ bridge: transport_type: streamable-http ``` -Each service appears separately on the bridge detail page, and you register each one as its own MCP server in C1 (Step 4), selecting it by its `name`. +Each service appears separately on the bridge detail page, and you add each one as its own External MCP source in C1 (Step 4), selecting it by its `name`. ### Other ways to supply config @@ -243,18 +243,18 @@ kubectl apply -f bridge-deployment.yaml After a few seconds, the bridge status changes to **Connected** in **Settings** > **Bridges**, and the service you configured appears on the bridge detail page. -## Step 4: Register the MCP server in C1 +## Step 4: Add the External MCP source in C1 -With the bridge running, register the server in C1 so its tools are available for governance. +With the bridge running, add an External MCP source in C1 so its tools are available for governance. -Open the app you want the MCP server registered under, go to its **MCP servers** tab, and click **Add MCP server**. +Open the app you want the MCP source linked to, go to its **Sources** tab, and click **Add MCP source**. -If you're starting from the tenant-wide MCP servers page (**AI** > **MCPs**) instead, the wizard adds a **Choose app** step so you can pick or create the destination app. +If you're starting from the tenant-wide Sources page (**AI** > **Sources**) instead, the wizard adds a **Choose app** step so you can pick or create the destination app. -Under **Choose a server**, select **External MCP server** — "Connect to an external MCP server by URL." +Under **Choose a source**, select **External MCP source** — "Connect to an external MCP server by URL." Under **Connectivity**, select **Private bridge** — "Route through a C1 Bridge running in your network." Then set: @@ -263,21 +263,21 @@ Under **Connectivity**, select **Private bridge** — "Route through a C1 Bridge - **Service** — the service your bridge advertised, which is the `name` field from `bridge.yaml` (`my-mcp` in the example). -Under **Configure**, enter a display name for the server. The **Server URL** field is read-only — it's resolved automatically from the bridge service you selected. +Under **Configure**, enter a display name for the source. The **Server URL** field is read-only — it's resolved automatically from the bridge service you selected. -In the **Authentication** section, pick the **Authentication method** C1 uses to reach your server — **Bearer token**, **Custom header**, **Basic auth**, or **OAuth2** — and enter the credentials it requires. Then click **Add server**. +In the **Authentication** section, pick the **Authentication method** C1 uses to reach your server — **Bearer token**, **Custom header**, **Basic auth**, or **OAuth2** — and enter the credentials it requires. Then click **Add source**. C1 connects to your server over the bridge and begins tool discovery. -A user can only call a tool once they're an **app user** of the app the server is registered under. New external apps start with no app users. When you register from an existing app that has none, the wizard inserts a **Link users** step to populate them by linking an entitlement from another app. When you start from the tenant-wide MCP servers page instead, you get the **Choose app** step (not **Link users**) — populate app users afterward from the app's settings. See [Calling the tools from an AI client](#calling-the-tools-from-an-ai-client) for the full set of ways to do this. +A user can only call a tool once they're an **app user** of the app the source is linked to. New external apps start with no app users. When you add a source from an existing app that has none, the wizard inserts a **Link users** step to populate them by linking an entitlement from another app. When you start from the tenant-wide Sources page instead, you get the **Choose app** step (not **Link users**) — populate app users afterward from the app's settings. See [Calling the tools from an AI client](#calling-the-tools-from-an-ai-client) for the full set of ways to do this. ## Step 5: Review discovered tools -After you click **Add server**, C1 connects to your MCP server over the bridge and pulls its tool list. The wizard's final step shows these discovered tools. +After you click **Add source**, C1 connects to your MCP server over the bridge and pulls its tool list. The wizard's final step shows these discovered tools. C1 records each tool's name, description, and input schema exactly as your MCP server advertises them, and surfaces that text to AI clients during discovery. The agent relies on it to decide which tool fits a request — so clear, accurate tool descriptions and schemas on your server directly affect how reliably the right tool gets found and called. @@ -287,7 +287,7 @@ Each tool: - Is **auto-classified** in the **Classification** column; you can change the classification. - Starts with **State** set to **Unset**. Flip the toggle to **Enabled** to allow calls to that tool, or **Disabled** to block it for everyone. -You don't need to finish reviewing tools in the wizard. Click **Done** to close it, or **Open server** to go to the server detail page. New tools added to the server appear there automatically after discovery — there's no manual sync button, so if a tool isn't showing yet, wait a moment and refresh. +You don't need to finish reviewing tools in the wizard. Click **Done** to close it, or **Open source** to go to the source detail page. New tools added to the server appear there automatically after discovery — there's no manual sync button, so if a tool isn't showing yet, wait a moment and refresh. Setting a tool's state to **Enabled** makes it callable only by users who hold a grant for it — it doesn't grant access on its own. To grant access, add the tool to an MCP access profile and assign that profile to users. See [Govern tools and toolsets](/product/admin/tools-and-toolsets). @@ -296,8 +296,8 @@ Setting a tool's state to **Enabled** makes it callable only by users who hold a ## Step 6: Verify the connection - In **Settings** > **Bridges**, the bridge shows **Connected**, with your service listed. -- On the server's **Tools** tab in C1, the discovered tools appear. -- On the server's **Details** tab, **Test credentials** succeeds and reports the number of tools discovered over the bridge. +- On the source's **Tools** tab in C1, the discovered tools appear. +- On the source's **Details** tab, **Test credentials** succeeds and reports the number of tools discovered over the bridge. If something looks off, check the `bridge-client` logs. For a binary deployment, logs go to stdout/stderr. For Kubernetes: @@ -312,7 +312,7 @@ Once the bridge is running and tools are approved, your users reach them from th By default, these clients use **code mode**: instead of listing each tool as its own named tool, C1 exposes discovery and execution entrypoints (`describe` and `execute`), and the agent finds the tools it needs and invokes them by writing short code. Your bridged tools won't appear one by one in the client's tool list — that's expected, not a discovery failure. Governance is unchanged: every underlying call still runs the same per-tool checks — the tool must be **Enabled** and the caller must hold a grant. Code mode is a tenant-level AI governance setting (on by default); with it off — or for **Service** and **Ephemeral** client types — C1 instead exposes each enabled tool as a directly named tool. See [Code mode](/product/admin/code-mode) for how agents discover and call tools through these entrypoints. -A call only executes when the requesting user is an **app user** of the server's app and holds a grant for the tool. If the caller isn't yet an app user, the call opens an access request instead of running. App users come from the destination app's account sources. Populate them by linking an entitlement from another app (the **Link users** step during registration, or linked entitlements later in the app's settings), by importing a CSV of app users, or — if the app is backed by a connector — by syncing them from the connector. +A call only executes when the requesting user is an **app user** of the source's app and holds a grant for the tool. If the caller isn't yet an app user, the call opens an access request instead of running. App users come from the destination app's account sources. Populate them by linking an entitlement from another app (the **Link users** step while adding the source, or linked entitlements later in the app's settings), by importing a CSV of app users, or — if the app is backed by a connector — by syncing them from the connector. For end-user setup instructions, see [Connect your MCP client to C1](/product/how-to/connect-mcp-client). @@ -344,7 +344,7 @@ The `backend` `host:port` in your config is wrong, or the MCP server isn't runni -Check `service_path` and `transport_type` in `bridge.yaml`. The `service_path` must match the actual endpoint path your MCP server serves (for example, `/mcp`), and `transport_type` must match its transport. These values come from the config — the registration wizard doesn't let you override them. Also confirm you selected the right service in Step 4. +Check `service_path` and `transport_type` in `bridge.yaml`. The `service_path` must match the actual endpoint path your MCP server serves (for example, `/mcp`), and `transport_type` must match its transport. These values come from the config — the source setup wizard doesn't let you override them. Also confirm you selected the right service in Step 4. diff --git a/product/admin/mcp-server/metabase.mdx b/product/admin/mcp-server/metabase.mdx index 3dd9bbd0..c65b10cc 100644 --- a/product/admin/mcp-server/metabase.mdx +++ b/product/admin/mcp-server/metabase.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Metabase MCP server -description: Create a Metabase API key, then register the Metabase MCP server in C1 and govern the tools it exposes. -og:title: Set up the Metabase MCP server -og:description: Create a Metabase API key, then register the Metabase MCP server in C1 and govern the tools it exposes. +title: Set up the Metabase MCP source +description: Create a Metabase API key, then add Metabase as a Catalog MCP source in C1 and govern the tools it exposes. +og:title: Set up the Metabase MCP source +og:description: Create a Metabase API key, then add Metabase as a Catalog MCP source in C1 and govern the tools it exposes. sidebarTitle: Metabase --- @@ -12,7 +12,7 @@ sidebarTitle: Metabase **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Metabase MCP server lets you govern access to Metabase — dashboards, questions, collections, databases, and users — as tools your AI clients can call through C1. +The Metabase Catalog MCP source lets you govern access to Metabase — dashboards, questions, collections, databases, and users — as tools your AI clients can call through C1. Metabase authenticates with an API key that C1 sends in a request header. A single key authenticates everyone, so all tool calls reach Metabase as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Metabase on your users - A Metabase admin account that can create API keys. An API key inherits the permissions of the group you assign it to, so assign a group that has the access you want this integration to have. -If you don't see **Metabase** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Metabase** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Metabase API key @@ -56,15 +56,15 @@ For a shared production setup, assign the key to a dedicated group so activity i Every user's tool calls use the one API key you provided, so Metabase sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, assign the key to a dedicated group so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Metabase MCP server in C1 +## Add the Metabase Catalog MCP source in C1 -With your API key ready, register the server and provide it to C1. +With your API key ready, add the source and provide it to C1. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Metabase** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Metabase** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Custom header**. Set the header name to `X-Api-Key` and the value to your Metabase API key. Enter your Metabase instance URL when prompted. @@ -76,9 +76,9 @@ Save your changes. C1 starts a sync that discovers the tools the Metabase server ## Discover and govern tools -After you register the server, C1 runs tool discovery against Metabase. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Metabase. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Metabase tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/metronome.mdx b/product/admin/mcp-server/metronome.mdx index cce770a4..5430782f 100644 --- a/product/admin/mcp-server/metronome.mdx +++ b/product/admin/mcp-server/metronome.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Metronome MCP server -description: Create a Metronome API token, then register the Metronome MCP server in C1 and govern the tools your AI clients can call. -og:title: Set up the Metronome MCP server -og:description: Create a Metronome API token, then register the Metronome MCP server in C1 and govern the tools your AI clients can call. +title: Set up the Metronome MCP source +description: Create a Metronome API token, then add Metronome as a Catalog MCP source in C1 and govern the tools your AI clients can call. +og:title: Set up the Metronome MCP source +og:description: Create a Metronome API token, then add Metronome as a Catalog MCP source in C1 and govern the tools your AI clients can call. sidebarTitle: Metronome --- @@ -12,7 +12,7 @@ sidebarTitle: Metronome **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Metronome MCP server lets you govern access to Metronome — customers, contracts, invoices, billable metrics, products, rate cards, and usage data — as tools your AI clients can call through C1. +The Metronome Catalog MCP source lets you govern access to Metronome — customers, contracts, invoices, billable metrics, products, rate cards, and usage data — as tools your AI clients can call through C1. Metronome authenticates with an API token that C1 sends as a bearer token. A single token authenticates everyone, so all tool calls reach Metronome as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Metronome on your user - A Metronome account that can create API tokens. New tokens inherit the permissions of the user that created them, so create the token under an account that has the access you want this integration to have. -If you don't see **Metronome** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Metronome** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Metronome API token @@ -56,15 +56,15 @@ For a shared production setup, create the token under a dedicated service-accoun Every user's tool calls use the one API token you provided, so Metronome sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared production setup, create the token from a dedicated service-account user so Metronome activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Metronome MCP server in C1 +## Add the Metronome Catalog MCP source in C1 -With your API token ready, register the server and provide it to C1. +With your API token ready, add the source and provide it to C1. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Metronome** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Metronome** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your Metronome API token. @@ -76,9 +76,9 @@ Save your changes. C1 starts a sync that discovers the tools the Metronome serve ## Discover and govern tools -After you register the server, C1 runs tool discovery against Metronome. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Metronome. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Metronome tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/monday.mdx b/product/admin/mcp-server/monday.mdx index de3e9264..42b657e5 100644 --- a/product/admin/mcp-server/monday.mdx +++ b/product/admin/mcp-server/monday.mdx @@ -1,8 +1,8 @@ --- -title: Set up the monday.com MCP server -description: Connect monday.com to C1 through monday.com's own hosted MCP server or the monday.com API, then register the server and govern its tools. -og:title: Set up the monday.com MCP server -og:description: Connect monday.com to C1 through monday.com's own hosted MCP server or the monday.com API, then register the server and govern its tools. +title: Set up the monday.com MCP source +description: Connect monday.com to C1 through monday.com's own hosted MCP server or the monday.com API, then add the Catalog MCP source and govern its tools. +og:title: Set up the monday.com MCP source +og:description: Connect monday.com to C1 through monday.com's own hosted MCP server or the monday.com API, then add the Catalog MCP source and govern its tools. sidebarTitle: monday.com --- @@ -12,12 +12,12 @@ sidebarTitle: monday.com **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern monday.com access two ways. Both let your AI clients read from and act on monday.com through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog — and the two catalog names are easy to mix up: +C1 can govern monday.com access two ways. Both let your AI clients read from and act on monday.com through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog — and the two catalog names are easy to mix up: -- **Monday** — the native MCP option. C1 registers monday.com's own hosted MCP server (`mcp.monday.com`) as a downstream server C1 governs. Authentication is always per-user OAuth using dynamic client registration (DCR) — monday.com's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in monday.com first. Tool calls run with the connected user's full monday.com permissions. +- **Monday** — the native MCP option. C1 adds monday.com's own hosted MCP server (`mcp.monday.com`) as a Catalog MCP source. Authentication is always per-user OAuth using dynamic client registration (DCR) — monday.com's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in monday.com first. Tool calls run with the connected user's full monday.com permissions. - **monday.com** — the API option. C1 hosts its own MCP server that translates monday.com's REST/GraphQL API into tools. Authentication is a single personal API token sent as a bearer token, so all tool calls reach monday.com as one shared identity. -In your catalog, the bare name **Monday** always means the native hosted-MCP option, and **monday.com** always means the API option below — the two entries are distinct servers with different authentication models, not two names for the same thing. +In your catalog, the bare name **Monday** always means the native hosted-MCP option, and **monday.com** always means the API option below — the two entries are distinct sources with different authentication models, not two names for the same thing. | | Monday | monday.com | | :--- | :--- | :--- | @@ -25,7 +25,7 @@ In your catalog, the bare name **Monday** always means the native hosted-MCP opt | **Authentication** | Per-user OAuth with dynamic client registration (DCR) only — no bearer token or API key option | A single personal API token, sent as a bearer token | | **Access scoping** | The connected user's full monday.com permissions — not independently scoped, though an account admin can still limit hosted MCP to specific workspaces | Whatever workspace, board, column, and item access the token's creator has — not independently scoped | | **Tool surface** | monday.com's own tool set: search, boards, items and subitems, updates, docs, dashboards, workflows, and automations | Boards, items, columns, groups, workspaces, and users, mapped to monday.com API endpoints | -| **Setup effort** | An account admin must first turn on hosted MCP access in monday.com, then register in C1 and authorize | Create a personal API token in monday.com, then register it in C1 | +| **Setup effort** | An account admin must first turn on hosted MCP access in monday.com, then add the source in C1 and authorize | Create a personal API token in monday.com, then add the source in C1 | Use the native **Monday** option if you want monday.com's own broader, agentic tool set and per-user OAuth is acceptable for your tenant. Use **monday.com** if you need a shared service-account credential instead of per-user login. @@ -42,7 +42,7 @@ C1 registers as a client of monday.com's own hosted MCP server ([monday MCP: Con - Nothing to create in monday.com ahead of time. This option only supports per-user OAuth with dynamic client registration — there's no client ID, secret, bearer token, or API key mode, so there's no integration to register in monday.com first. Each user just needs a monday.com account with access to the workspace you want to govern. -In your MCP server catalog, this option is listed as **Monday** — distinct from the **monday.com** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Monday** — distinct from the **monday.com** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Set up per-user OAuth with dynamic client registration @@ -51,7 +51,7 @@ Per-user OAuth with dynamic client registration (DCR) is the only authentication -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Monday** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Monday** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enable **Use dynamic client registration**. There's no client ID or secret to enter. @@ -71,9 +71,9 @@ This option only supports per-user OAuth — there's no shared, service-account, ## Discover and govern tools -After you register the server, C1 runs tool discovery against monday.com's MCP server. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against monday.com's MCP server. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Monday tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -99,7 +99,7 @@ monday.com authenticates with a personal API token that C1 sends as a bearer tok - A monday.com account that can generate a personal API token, with access to the boards and workspaces you want this integration to have. -In your MCP server catalog, this option is listed as **monday.com** — distinct from the **Monday** entry, which connects to monday.com's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **monday.com** — distinct from the **Monday** entry, which connects to monday.com's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a monday.com personal API token @@ -124,15 +124,15 @@ A personal token inherits whatever workspace, board, column, and item permission Every user's tool calls use the one API token you provided, so monday.com sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the monday.com MCP server in C1 +## Add the monday.com Catalog MCP source in C1 -With your API token ready, register the server and provide it to C1. +With your API token ready, add the source and provide it to C1. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **monday.com** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **monday.com** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your personal API token. @@ -144,9 +144,9 @@ Save your changes. C1 starts a sync that discovers the tools the monday.com serv ## Discover and govern tools -After you register the server, C1 runs tool discovery against monday.com. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against monday.com. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a monday.com tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/n8n.mdx b/product/admin/mcp-server/n8n.mdx index 8a567481..7f35fc58 100644 --- a/product/admin/mcp-server/n8n.mdx +++ b/product/admin/mcp-server/n8n.mdx @@ -1,8 +1,8 @@ --- -title: Set up the n8n MCP server -description: Connect n8n to C1 through n8n's own hosted MCP server (n8n Cloud only) or the n8n API, then register the server and govern its tools. -og:title: Set up the n8n MCP server -og:description: Connect n8n to C1 through n8n's own hosted MCP server (n8n Cloud only) or the n8n API, then register the server and govern its tools. +title: Set up the n8n MCP source +description: Connect n8n to C1 through n8n's own hosted MCP server (n8n Cloud only) or the n8n API, then add the Catalog MCP source and govern its tools. +og:title: Set up the n8n MCP source +og:description: Connect n8n to C1 through n8n's own hosted MCP server (n8n Cloud only) or the n8n API, then add the Catalog MCP source and govern its tools. sidebarTitle: n8n --- @@ -12,12 +12,12 @@ sidebarTitle: n8n **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern n8n access two ways. Both let your AI clients read from and act on n8n through governed MCP tools, but they support different n8n deployments and appear as two separate entries in your MCP server catalog: +C1 can govern n8n access two ways. Both let your AI clients read from and act on n8n through governed MCP tools, but they support different n8n deployments and appear as two separate entries in your MCP source catalog: -- **n8n MCP** — listed as plain **n8n** in your catalog. C1 registers n8n's own hosted MCP server as a downstream server C1 governs. **This option works with n8n Cloud only.** Authentication is per-user OAuth 2.1 (dynamic client registration recommended), or a personal access token as a bearer credential fallback. +- **n8n MCP** — listed as plain **n8n** in your catalog. C1 adds n8n's own hosted MCP server as a Catalog MCP source. **This option works with n8n Cloud only.** Authentication is per-user OAuth 2.1 (dynamic client registration recommended), or a personal access token as a bearer credential fallback. - **n8n API** — C1 hosts its own MCP server that translates n8n's REST API into tools. A single API key authenticates every user as one shared identity. This works with **either n8n Cloud or a self-hosted n8n instance**. -**Use n8n MCP only if you're on n8n Cloud.** Self-hosted n8n instances can't use this option — use **n8n API** instead, or, if your self-hosted instance exposes its own MCP server, connect it to C1 as an external MCP server. +**Use n8n MCP only if you're on n8n Cloud.** Self-hosted n8n instances can't use this option — use **n8n API** instead, or, if your self-hosted instance exposes its own MCP server, add it to C1 as an External MCP source. | | n8n MCP | n8n API | | :--- | :--- | :--- | @@ -26,7 +26,7 @@ C1 can govern n8n access two ways. Both let your AI clients read from and act on | **Authentication** | Per-user OAuth 2.1 with dynamic client registration (recommended), or a personal access token (bearer) | A single shared API key (custom header) | | **Access scoping** | The connected user's own n8n permissions in that workspace, or the token owner's permissions if using a personal access token | Whatever the API key's owning n8n user account can access | | **Tool surface** | n8n's own instance-level MCP tools: workflow search, execution, testing, and publishing; execution history; credential listing; workflow building and validation; data tables | Workflows, executions, credentials, tags, and users, mapped to n8n API endpoints | -| **Setup effort** | Register in C1 and authorize — nothing to create in n8n first (unless you choose a personal access token) | Create an n8n API key first, then register it in C1 | +| **Setup effort** | Add the source in C1 and authorize — nothing to create in n8n first (unless you choose a personal access token) | Create an n8n API key first, then add the source in C1 | Use the native **n8n MCP** option (listed as plain **n8n** in your catalog) if you're on n8n Cloud and want n8n's own broader tool set with per-user OAuth. Use **n8n API** if you're on a self-hosted instance, or you need a shared service-account credential. @@ -39,12 +39,12 @@ C1 registers as a client of n8n's own hosted MCP server rather than translating ## Before you begin - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management). -- **This option is n8n Cloud only.** If you run a self-hosted n8n instance, use the **n8n API** option instead, or, if your instance has its own MCP server enabled, register it in C1 as an external MCP server. -- Your n8n Cloud workspace name — the subdomain in `.app.n8n.cloud` (for example, enter `c1-mcp` for a workspace at `https://c1-mcp.app.n8n.cloud`). You'll enter this when you register the server. +- **This option is n8n Cloud only.** If you run a self-hosted n8n instance, use the **n8n API** option instead, or, if your instance has its own MCP server enabled, add it to C1 as an External MCP source. +- Your n8n Cloud workspace name — the subdomain in `.app.n8n.cloud` (for example, enter `c1-mcp` for a workspace at `https://c1-mcp.app.n8n.cloud`). You'll enter this when you add the source. - A user account on the n8n Cloud workspace (for per-user OAuth), or a personal access token (for the bearer fallback). -In your MCP server catalog, this option is listed as **n8n** — distinct from the **n8n API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **n8n** — distinct from the **n8n API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Set up per-user OAuth (recommended) @@ -53,7 +53,7 @@ Per-user OAuth 2.1 with dynamic client registration (DCR) is the recommended way -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **n8n** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **n8n** from the catalog. Enter your n8n Cloud workspace name when prompted. @@ -83,11 +83,11 @@ Open **Connection details**, then switch to the **Access Token** tab. n8n genera For a shared production setup, generate the token from a dedicated service-account user so activity is attributable to C1 rather than a person. -Then register the server with that token: +Then add the source with that token: -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **n8n** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **n8n** from the catalog. Enter your n8n Cloud workspace name. @@ -114,9 +114,9 @@ Access depends on the authentication method you chose: ## Discover and govern tools -After you register the server, C1 runs tool discovery against n8n's MCP server. Discovered tools appear on the server's **Tools** tab and include n8n's own workflow search, execution, testing, and publishing tools; execution history lookups; credential listing; workflow building and validation; and data table management. +After you add the source, C1 runs tool discovery against n8n's MCP server. Discovered tools appear on the source's **Tools** tab and include n8n's own workflow search, execution, testing, and publishing tools; execution history lookups; credential listing; workflow building and validation; and data table management. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an n8n tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -133,7 +133,7 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove -The n8n MCP server lets you govern access to n8n — workflows, executions, credentials, tags, and users — as tools your AI clients can call through C1. This option connects to a self-hosted n8n instance, or to an n8n Cloud workspace, through n8n's REST API. +The n8n Catalog MCP source lets you govern access to n8n — workflows, executions, credentials, tags, and users — as tools your AI clients can call through C1. This option connects to a self-hosted n8n instance, or to an n8n Cloud workspace, through n8n's REST API. n8n authenticates with an API key that C1 sends in a request header. A single key authenticates everyone, so all tool calls reach n8n as one shared identity. @@ -150,7 +150,7 @@ The credentials you set up below are what C1 uses to call n8n on your users' beh - The base URL of your n8n instance, reachable from C1. -If you don't see **n8n API** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **n8n API** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create an n8n API key @@ -175,15 +175,15 @@ For a shared production setup, create the key from a dedicated service-account u Every user's tool calls use the one API key you provided, so n8n sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, create the key from a dedicated service-account user so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the n8n MCP server in C1 +## Add the n8n Catalog MCP source in C1 -With your API key ready, register the server and provide it to C1. +With your API key ready, add the source and provide it to C1. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **n8n API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **n8n API** from the catalog. Enter the base URL of your n8n instance when prompted. @@ -198,9 +198,9 @@ Save your changes. C1 starts a sync that discovers the tools the n8n server expo ## Discover and govern tools -After you register the server, C1 runs tool discovery against n8n. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against n8n. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an n8n tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/notion.mdx b/product/admin/mcp-server/notion.mdx index 24b002f4..0379e51a 100644 --- a/product/admin/mcp-server/notion.mdx +++ b/product/admin/mcp-server/notion.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Notion MCP server -description: Connect Notion to C1 through the Notion API or Notion's own hosted MCP server, then register the server and govern its tools. -og:title: Set up the Notion MCP server -og:description: Connect Notion to C1 through the Notion API or Notion's own hosted MCP server, then register the server and govern its tools. +title: Set up the Notion MCP source +description: Connect Notion to C1 through the Notion API or Notion's own hosted MCP server, then add the Catalog MCP source and govern its tools. +og:title: Set up the Notion MCP source +og:description: Connect Notion to C1 through the Notion API or Notion's own hosted MCP server, then add the Catalog MCP source and govern its tools. sidebarTitle: Notion --- @@ -12,9 +12,9 @@ sidebarTitle: Notion **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern Notion access two ways. Both let your AI clients read from and act on Notion through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: +C1 can govern Notion access two ways. Both let your AI clients read from and act on Notion through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog: -- **Notion MCP** — listed as plain **Notion** in your catalog. C1 registers Notion's own hosted MCP server (`mcp.notion.com`) as a downstream server C1 governs. Authentication is always per-user OAuth using dynamic client registration (DCR) — Notion's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in Notion first. Tool calls run with the connected user's full Notion permissions, plus whatever connected sources (Slack, Google Drive, GitHub, Jira, Microsoft Teams, SharePoint, OneDrive, Linear) their Notion AI connectors expose. +- **Notion MCP** — listed as plain **Notion** in your catalog. C1 adds Notion's own hosted MCP server (`mcp.notion.com`) as a Catalog MCP source. Authentication is always per-user OAuth using dynamic client registration (DCR) — Notion's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in Notion first. Tool calls run with the connected user's full Notion permissions, plus whatever connected sources (Slack, Google Drive, GitHub, Jira, Microsoft Teams, SharePoint, OneDrive, Linear) their Notion AI connectors expose. - **Notion API** — C1 hosts its own MCP server that translates Notion's REST API into tools. You choose between per-user OAuth or a shared internal integration secret (a bearer token), and you scope access with the **capabilities** you grant the Notion integration (read/update/insert content, comments, user information). | | Notion MCP | Notion API | @@ -23,7 +23,7 @@ C1 can govern Notion access two ways. Both let your AI clients read from and act | **Authentication** | Per-user OAuth with dynamic client registration (DCR) only — no bearer token or API key option | Per-user OAuth, or a shared internal integration secret (bearer token) | | **Access scoping** | The connected user's full Notion permissions — not independently scoped | The Notion **capabilities** you configure on the integration | | **Tool surface** | Notion's own tool set: cross-source search, page and database creation/editing, page duplication, database views, comments, teamspaces, and users | Pages, databases, blocks, comments, users, and search, mapped to Notion API endpoints | -| **Setup effort** | Register in C1 and authorize — nothing to create in Notion first | Create a Notion integration (public or internal) first, then register it in C1 | +| **Setup effort** | Add the source in C1 and authorize — nothing to create in Notion first | Create a Notion integration (public or internal) first, then add the source in C1 | Use the native **Notion MCP** option (listed as plain **Notion** in your catalog) if you want Notion's own broader, agentic tool set — including cross-source search — and per-user OAuth is acceptable for your tenant. Use **Notion API** if you need a shared service-account credential (bearer token), or you want to scope access with Notion's capability toggles. @@ -40,7 +40,7 @@ C1 registers as a client of Notion's own hosted MCP server ([Notion MCP](https:/ - To search and read from connected sources (Slack, Google Drive, GitHub, Jira, Microsoft Teams, SharePoint, OneDrive, Linear) through Notion MCP, users need those connectors set up on the Notion side. See Notion's [Notion MCP](https://www.notion.com/help/notion-mcp) documentation. -In your MCP server catalog, this option is listed as **Notion** — distinct from the **Notion API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Notion** — distinct from the **Notion API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Set up per-user OAuth @@ -49,7 +49,7 @@ Per-user OAuth with dynamic client registration (DCR) is the only authentication -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Notion** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Notion** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enable **Use dynamic client registration**. There's no client ID or secret to enter. @@ -69,9 +69,9 @@ This option only supports per-user OAuth — there's no shared, service-account, ## Discover and govern tools -After you register the server, C1 runs tool discovery against Notion's MCP server. Discovered tools appear on the server's **Tools** tab and include Notion's own search and fetch tools, page and database creation and editing, page duplication, comments, teamspaces, users, and database views. +After you add the source, C1 runs tool discovery against Notion's MCP server. Discovered tools appear on the source's **Tools** tab and include Notion's own search and fetch tools, page and database creation and editing, page duplication, comments, teamspaces, users, and database views. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Notion tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -92,7 +92,7 @@ Because this option uses per-user OAuth, there's no shared secret in C1 to rotat C1 hosts the Notion MCP server, so your users' AI clients only ever see MCP tools — they never call Notion directly. When an AI client calls one of these tools, C1 makes the matching request to the Notion API using the credentials you configure here, then returns the result to the AI client. -Notion supports two ways to authenticate, and you choose one when you register the server: +Notion supports two ways to authenticate, and you choose one when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own Notion account, so every tool call runs under that user's Notion identity and permissions. - **Internal integration secret**. A single bearer token authenticates everyone, so all tool calls reach Notion as one shared identity. @@ -106,7 +106,7 @@ For a deeper comparison of shared versus per-user credentials, see [Configure au - For an internal integration secret, you need to be a **Workspace Owner** of the Notion workspace. -In your MCP server catalog, this option is listed as **Notion API** — distinct from the **Notion** entry, which connects to Notion's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Notion API** — distinct from the **Notion** entry, which connects to Notion's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -137,11 +137,11 @@ Copy the integration's **Client ID** and **Client Secret**. -With your public integration ready, register the server and provide its credentials to C1: +With your public integration ready, add the source and provide its credentials to C1: -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Notion API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Notion API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your integration's **client ID** and **client secret**. @@ -177,11 +177,11 @@ Connect the integration to the pages it should reach. An internal integration se For a shared production setup, create the integration from a dedicated service-account user so activity is attributable to C1 rather than a person. -With your internal integration secret ready, register the server and provide it to C1: +With your internal integration secret ready, add the source and provide it to C1: -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Notion API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Notion API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your internal integration secret. @@ -198,13 +198,13 @@ How Notion sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Notion account, so tool calls run under that user's Notion identity and inherit only the access they already have. Notion attributes each action to the individual user. - **Internal integration secret.** Every user's tool calls use the one secret you provided, so Notion sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Notion. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Notion. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Notion tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -214,7 +214,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Notion API credentials -- **Rotate the OAuth client secret** on your public integration's **Configuration** tab in Notion, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** on your public integration's **Configuration** tab in Notion, then update the secret on the source's authentication settings in C1. - **Rotate the internal integration secret** by regenerating it on the integration's **Configuration** tab in Notion and updating it in C1. - **Adjust access** by editing the integration's capabilities, and for an internal integration, the set of pages it's connected to. diff --git a/product/admin/mcp-server/okta.mdx b/product/admin/mcp-server/okta.mdx index a674ef1f..83a4d134 100644 --- a/product/admin/mcp-server/okta.mdx +++ b/product/admin/mcp-server/okta.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Okta MCP server -description: Create an Okta OIDC app, grant the Okta API scopes C1 needs, and register the Okta MCP server so your AI clients read Okta directory data through governed tools. -og:title: Set up the Okta MCP server -og:description: Create an Okta OIDC app, grant the Okta API scopes C1 needs, and register the Okta MCP server so your AI clients read Okta directory data through governed tools. +title: Set up the Okta MCP source +description: Create an Okta OIDC app, grant the Okta API scopes C1 needs, and add Okta as a Catalog MCP source so your AI clients read Okta directory data through governed tools. +og:title: Set up the Okta MCP source +og:description: Create an Okta OIDC app, grant the Okta API scopes C1 needs, and add Okta as a Catalog MCP source so your AI clients read Okta directory data through governed tools. sidebarTitle: Okta --- @@ -12,7 +12,7 @@ sidebarTitle: Okta **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Okta MCP server lets you govern access to Okta directory data — users, groups, applications, devices, and organization configuration exposed by the Okta management APIs — as tools your AI clients call through C1. +The Okta Catalog MCP source lets you govern access to Okta directory data — users, groups, applications, devices, and organization configuration exposed by the Okta management APIs — as tools your AI clients call through C1. The server is read-only by default: it requests read scopes and exposes read tools. To enable tools that modify Okta, you grant the matching management scopes — see [Okta API scopes](#okta-api-scopes). @@ -40,7 +40,7 @@ C1 hosts the Okta MCP server, so your users' AI clients only ever see MCP tools - Your Okta organization URL, such as `https://acme.okta.com`. -If you don't see **Okta** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Okta** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create an Okta OIDC app @@ -71,7 +71,7 @@ On the app's **General** tab, copy the **Client ID** and **Client secret**. Okta -Your Okta OIDC app is ready to connect. Keep the client ID and secret for [Register the Okta MCP server in C1](#register-the-okta-mcp-server-in-c1). +Your Okta OIDC app is ready to connect. Keep the client ID and secret for [Add the Okta Catalog MCP source in C1](#add-the-okta-catalog-mcp-source-in-c1). ## Okta API scopes @@ -112,15 +112,15 @@ How Okta sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Okta account, so tool calls run under that user's Okta identity and inherit only the admin permissions they already have. Okta attributes each action to the individual user. - **Service mode.** An administrator authorizes once, so every user's tool calls reach Okta as one shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). Authorize from a dedicated service-account user so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Okta MCP server in C1 +## Add the Okta Catalog MCP source in C1 -With your OAuth app ready, register the server and provide your credentials. +With your OAuth app ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Okta** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Okta** from the catalog. Enter your Okta organization URL, such as `https://acme.okta.com`. @@ -135,9 +135,9 @@ Save your changes. With per-user OAuth, the first time a user calls an Okta tool ## Discover and govern tools -After you register the server, C1 runs tool discovery against Okta. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Okta. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Okta tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -147,5 +147,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Okta credentials -- **Rotate the OAuth client secret** in your Okta app under **Applications** > **Applications**, then update the secret in the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your Okta app under **Applications** > **Applications**, then update the secret in the source's authentication settings in C1. - **Adjust access** by granting or revoking Okta API scopes on the app's **Okta API Scopes** tab, then updating the scopes in C1 to match. Users reconnect their Okta account for scope changes to take effect. diff --git a/product/admin/mcp-server/opsgenie.mdx b/product/admin/mcp-server/opsgenie.mdx index 33f9d915..6af2fae6 100644 --- a/product/admin/mcp-server/opsgenie.mdx +++ b/product/admin/mcp-server/opsgenie.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Opsgenie MCP server -description: Create an Opsgenie API key, then register the Opsgenie MCP server in C1 and govern the tools it exposes. -og:title: Set up the Opsgenie MCP server -og:description: Create an Opsgenie API key, then register the Opsgenie MCP server in C1 and govern the tools it exposes. +title: Set up the Opsgenie MCP source +description: Create an Opsgenie API key, then add Opsgenie as a Catalog MCP source in C1 and govern the tools it exposes. +og:title: Set up the Opsgenie MCP source +og:description: Create an Opsgenie API key, then add Opsgenie as a Catalog MCP source in C1 and govern the tools it exposes. sidebarTitle: Opsgenie --- @@ -12,7 +12,7 @@ sidebarTitle: Opsgenie **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Opsgenie MCP server lets you govern access to Opsgenie — alerts, escalations, schedules, on-call data, teams, and users — as tools your AI clients can call through C1. +The Opsgenie Catalog MCP source lets you govern access to Opsgenie — alerts, escalations, schedules, on-call data, teams, and users — as tools your AI clients can call through C1. Opsgenie authenticates with an API key. A single key authenticates everyone, so all tool calls reach Opsgenie as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Opsgenie on your users - An Opsgenie account with permission to create an API integration or API key for the operations you plan to govern. -If you don't see **Opsgenie** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Opsgenie** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create an Opsgenie API key @@ -53,15 +53,15 @@ For a shared production setup, create the API key from a dedicated service accou Every user's tool calls use the one API key you provided, so Opsgenie sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated service account so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Opsgenie MCP server in C1 +## Add the Opsgenie Catalog MCP source in C1 -With your API key ready, register the server and provide your credentials. +With your API key ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Opsgenie** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Opsgenie** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Custom header**. Set the header name to `Authorization` and the value to `GenieKey ` followed by your API key (for example, `GenieKey abc123`). @@ -73,9 +73,9 @@ Save your changes. C1 starts a sync that discovers the tools the Opsgenie server ## Discover and govern tools -After you register the server, C1 runs tool discovery against Opsgenie. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Opsgenie. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Opsgenie tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/pagerduty.mdx b/product/admin/mcp-server/pagerduty.mdx index b3eda3d7..6c4b0737 100644 --- a/product/admin/mcp-server/pagerduty.mdx +++ b/product/admin/mcp-server/pagerduty.mdx @@ -1,8 +1,8 @@ --- -title: Set up the PagerDuty MCP server -description: Connect PagerDuty to C1 through the PagerDuty REST API or PagerDuty's own hosted MCP server, then register the server and govern its tools. -og:title: Set up the PagerDuty MCP server -og:description: Connect PagerDuty to C1 through the PagerDuty REST API or PagerDuty's own hosted MCP server, then register the server and govern its tools. +title: Set up the PagerDuty MCP source +description: Connect PagerDuty to C1 through the PagerDuty REST API or PagerDuty's own hosted MCP server, then add the Catalog MCP source and govern its tools. +og:title: Set up the PagerDuty MCP source +og:description: Connect PagerDuty to C1 through the PagerDuty REST API or PagerDuty's own hosted MCP server, then add the Catalog MCP source and govern its tools. sidebarTitle: PagerDuty --- @@ -12,9 +12,9 @@ sidebarTitle: PagerDuty **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern PagerDuty access two ways. Both let your AI clients read from and act on PagerDuty through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: +C1 can govern PagerDuty access two ways. Both let your AI clients read from and act on PagerDuty through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog: -- **PagerDuty MCP** — listed as plain **PagerDuty** in your catalog. C1 registers PagerDuty's own hosted MCP server (`mcp.pagerduty.com`) as a downstream server C1 governs. Authenticate with per-user OAuth — using a Scoped OAuth application you register manually in PagerDuty, since PagerDuty's hosted MCP server doesn't support dynamic client registration (DCR) — or with a shared API key or user token. Tool calls run with whichever identity you authenticated. +- **PagerDuty MCP** — listed as plain **PagerDuty** in your catalog. C1 adds PagerDuty's own hosted MCP server (`mcp.pagerduty.com`) as a Catalog MCP source. Authenticate with per-user OAuth — using a Scoped OAuth application you register manually in PagerDuty, since PagerDuty's hosted MCP server doesn't support dynamic client registration (DCR) — or with a shared API key or user token. Tool calls run with whichever identity you authenticated. - **PagerDuty API** — C1 hosts its own MCP server that translates PagerDuty's REST API into tools. You choose between per-user OAuth or a shared REST API key, and access is scoped to the OAuth app's granted scopes or the REST API key's permissions. | | PagerDuty MCP | PagerDuty API | @@ -23,7 +23,7 @@ C1 can govern PagerDuty access two ways. Both let your AI clients read from and | **Authentication** | Per-user OAuth with a manually registered Scoped OAuth application (no DCR), or a shared API key / user token (bearer) | Per-user OAuth, or a shared REST API key (bearer token) | | **Access scoping** | The connected identity's own PagerDuty permissions, within whatever scopes the OAuth app was granted — not independently scoped by C1 | The scopes you grant the OAuth app, or the permissions of the REST API key you provide | | **Tool surface** | PagerDuty's own tool set: incidents, services, on-call schedules, escalation policies, teams, event orchestrations, status pages, and more | Incidents, services, schedules, escalation policies, and users, mapped to PagerDuty REST API endpoints | -| **Setup effort** | Register a Scoped OAuth application in PagerDuty (or create an API key), then register it in C1 — no automatic registration | Register an OAuth app or create a REST API key in PagerDuty, then register it in C1 | +| **Setup effort** | Register a Scoped OAuth application in PagerDuty (or create an API key), then add the source in C1 — no automatic registration | Register an OAuth app or create a REST API key in PagerDuty, then add the source in C1 | Use the native **PagerDuty MCP** option (listed as plain **PagerDuty** in your catalog) if you want PagerDuty's own broader, agentic tool set and you're prepared to manually register a Scoped OAuth application (or use an API key). Use **PagerDuty API** if you'd rather scope access purely through PagerDuty's REST API scopes with either credential type. @@ -38,10 +38,10 @@ C1 registers as a client of PagerDuty's own hosted MCP server ([PagerDuty MCP Se - AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management). - For per-user OAuth, you need permission to register a Scoped OAuth application in PagerDuty — this requires an account admin or owner role. Regular users are limited to **Classic User OAuth**, which C1 doesn't use here, since it only supports coarse and unreliable access. - For an API key or user token, you need a PagerDuty account that can create a REST API key, or your own user account to create a personal token. -- PagerDuty's hosted MCP server doesn't support OAuth dynamic client registration (DCR). Unlike some other native MCP integrations, per-user OAuth here always starts with an application you register yourself — there's no automatic client registration to skip. +- PagerDuty's hosted MCP server doesn't support OAuth dynamic client registration (DCR). Unlike some other Catalog MCP sources, per-user OAuth here always starts with an application you register yourself — there's no automatic client registration to skip. -In your MCP server catalog, this option is listed as **PagerDuty** — distinct from the **PagerDuty API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **PagerDuty** — distinct from the **PagerDuty API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -91,13 +91,13 @@ Select **Register App**, then copy the **Client ID** and **Client Secret** from -### Register the server with OAuth +### Add the source with OAuth -With your Scoped OAuth application ready, register the server and provide your credentials: +With your Scoped OAuth application ready, add the source and provide your credentials: -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **PagerDuty** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enter your application's **client ID** and **client secret**. @@ -119,7 +119,7 @@ In PagerDuty, go to **Integrations** > **API Access Keys** and select **Create N Give the key a recognizable description such as `C1`, then copy it. PagerDuty shows it only once. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **PagerDuty** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your API key or user token. @@ -146,9 +146,9 @@ How PagerDuty sees your users' activity depends on the method you chose: ## Discover and govern tools -After you register the server, C1 runs tool discovery against PagerDuty's hosted MCP server. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against PagerDuty's hosted MCP server. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a PagerDuty tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -158,7 +158,7 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove ## Manage access to PagerDuty MCP -- **Rotate the OAuth client secret** in your PagerDuty app under **Integrations** > **App Registration**, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your PagerDuty app under **Integrations** > **App Registration**, then update the secret on the source's authentication settings in C1. - **Rotate an API key or user token** by creating a new one in PagerDuty and updating it in C1, then delete the old one. - **Revoke access** from the app's page in **App Registration** — revoke its tokens to invalidate every session at once, or delete the app entirely. - **Adjust scopes** by editing them on the OAuth application in PagerDuty, or by choosing a read-only versus full-access API key. @@ -167,9 +167,9 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove -The PagerDuty MCP server lets you govern access to PagerDuty — incidents, services, schedules, escalation policies, and users exposed by the PagerDuty REST API — as tools your AI clients can call through C1. +The PagerDuty Catalog MCP source lets you govern access to PagerDuty — incidents, services, schedules, escalation policies, and users exposed by the PagerDuty REST API — as tools your AI clients can call through C1. -PagerDuty supports two ways to authenticate, and you choose one when you register the server: +PagerDuty supports two ways to authenticate, and you choose one when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own PagerDuty account, so every tool call runs under that user's PagerDuty identity and permissions. - **REST API key**. A single key authenticates everyone, so all tool calls reach PagerDuty as one shared identity. @@ -189,7 +189,7 @@ The credentials you set up below are what C1 uses to call PagerDuty on your user - For a REST API key, you need a PagerDuty account that can create a REST API key, and the email address of a valid PagerDuty user to record as the actor on write operations. -In your MCP server catalog, this option is listed as **PagerDuty API** — distinct from the **PagerDuty** entry, which connects to PagerDuty's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **PagerDuty API** — distinct from the **PagerDuty** entry, which connects to PagerDuty's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Set up per-user OAuth @@ -216,13 +216,13 @@ Save the app, then copy the **Client ID** and **Client Secret**. PagerDuty shows -### Register the server with OAuth +### Add the source with OAuth -With your OAuth app ready, register the server and provide your credentials. +With your OAuth app ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **PagerDuty API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your OAuth app's **client ID**, **client secret**, and the **scopes** you granted. @@ -254,13 +254,13 @@ Select **Create Key** and copy the key. PagerDuty shows the key only once. For a shared production setup, create the key from a dedicated service-account user so activity is attributable to C1 rather than a person. -### Register the server with a REST API key +### Add the source with a REST API key -With your REST API key ready, register the server and provide your credentials. +With your REST API key ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **PagerDuty API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **PagerDuty API** from the catalog. Enter the **actor email** — the email of a valid PagerDuty user to record as the actor on write operations such as acknowledging or resolving incidents. @@ -280,13 +280,13 @@ How PagerDuty sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own PagerDuty account, so tool calls run under that user's PagerDuty identity and inherit only the access they already have. PagerDuty attributes each action to the individual user. - **REST API key.** Every user's tool calls use the one key you provided, so PagerDuty sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against PagerDuty. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against PagerDuty. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a PagerDuty tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -296,7 +296,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your PagerDuty credentials -- **Rotate the OAuth client secret** in your PagerDuty app under **Integrations** > **Developer Tools** > **App Registration**, then update the secret on the server's authentication settings in C1. +- **Rotate the OAuth client secret** in your PagerDuty app under **Integrations** > **Developer Tools** > **App Registration**, then update the secret on the source's authentication settings in C1. - **Rotate a REST API key** by creating a new key in PagerDuty and updating it in C1, then delete the old key. - **Adjust access** by editing the OAuth app's scopes or by choosing a read-only versus full-access REST API key in PagerDuty. diff --git a/product/admin/mcp-server/pylon.mdx b/product/admin/mcp-server/pylon.mdx index 7efe92e8..60372f5e 100644 --- a/product/admin/mcp-server/pylon.mdx +++ b/product/admin/mcp-server/pylon.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Pylon MCP server -description: Connect Pylon to C1 through the Pylon API or Pylon's own hosted MCP server, then register the server and govern its tools. -og:title: Set up the Pylon MCP server -og:description: Connect Pylon to C1 through the Pylon API or Pylon's own hosted MCP server, then register the server and govern its tools. +title: Set up the Pylon MCP source +description: Connect Pylon to C1 through the Pylon API or Pylon's own hosted MCP server, then add the Catalog MCP source and govern its tools. +og:title: Set up the Pylon MCP source +og:description: Connect Pylon to C1 through the Pylon API or Pylon's own hosted MCP server, then add the Catalog MCP source and govern its tools. sidebarTitle: Pylon --- @@ -12,9 +12,9 @@ sidebarTitle: Pylon **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern [Pylon](https://www.usepylon.com/) access two ways. Both let your AI clients read from and act on Pylon through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: +C1 can govern [Pylon](https://www.usepylon.com/) access two ways. Both let your AI clients read from and act on Pylon through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog: -- **Pylon MCP** — listed as plain **Pylon** in your catalog. C1 registers Pylon's own hosted MCP server (`mcp.usepylon.com`) as a downstream server C1 governs. Authentication is always per-user OAuth using dynamic client registration (DCR) — Pylon's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in Pylon first. Tool calls run with the connected user's own Pylon seat permissions. +- **Pylon MCP** — listed as plain **Pylon** in your catalog. C1 adds Pylon's own hosted MCP server (`mcp.usepylon.com`) as a Catalog MCP source. Authentication is always per-user OAuth using dynamic client registration (DCR) — Pylon's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in Pylon first. Tool calls run with the connected user's own Pylon seat permissions. - **Pylon API** — C1 hosts its own MCP server that translates Pylon's REST API into tools. Authentication is a single shared bearer token (an API token generated in Pylon), so every tool call reaches Pylon as one shared identity. | | Pylon MCP | Pylon API | @@ -23,7 +23,7 @@ C1 can govern [Pylon](https://www.usepylon.com/) access two ways. Both let your | **Authentication** | Per-user OAuth with dynamic client registration (DCR) only — no bearer token or API key option | Bearer token (API token) only — no OAuth option | | **Access scoping** | The connected user's own Pylon seat and role permissions — not independently scoped | Whatever the API token's seat can reach in Pylon | | **Tool surface** | Pylon's own tool set: search, read, create, and update issues, accounts, and contacts | Issues, accounts, contacts, teams, users, knowledge bases, and tags, mapped to Pylon API endpoints | -| **Setup effort** | Register in C1 and authorize — nothing to create in Pylon first | Generate an API token in Pylon, then register it in C1 | +| **Setup effort** | Add the source in C1 and authorize — nothing to create in Pylon first | Generate an API token in Pylon, then add the source in C1 | Use the native **Pylon MCP** option (listed as plain **Pylon** in your catalog) if per-user OAuth is acceptable for your tenant and Pylon's own agentic tool set is enough. Use **Pylon API** if you need a shared service-account credential (bearer token) instead. @@ -40,7 +40,7 @@ C1 registers as a client of Pylon's own hosted MCP server ([Pylon MCP](https://d - A Pylon admin must first turn on the MCP server from **Settings → AI Controls → MCP Server** in the Pylon dashboard ([Pylon MCP](https://docs.usepylon.com/pylon-docs/integrations/pylon-mcp#setup-in-pylon)). Each person who will connect needs a **Member** or **Admin** seat with the **MCP Access** role enabled; **Viewer** and **Integration** seats can't authenticate and see an "Authorization failed" error ([Connecting to the Pylon MCP Server](https://support.usepylon.com/articles/2407390554-connecting-to-the-pylon-mcp-server)). -In your MCP server catalog, this option is listed as **Pylon** — distinct from the **Pylon API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Pylon** — distinct from the **Pylon API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Set up per-user OAuth @@ -49,7 +49,7 @@ Per-user OAuth with dynamic client registration (DCR) is the only authentication -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Pylon** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Pylon** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enable **Use dynamic client registration**. There's no client ID or secret to enter. @@ -69,9 +69,9 @@ This option only supports per-user OAuth — there's no shared, service-account, ## Discover and govern tools -After you register the server, C1 runs tool discovery against Pylon's MCP server. Discovered tools appear on the server's **Tools** tab and include Pylon's own search, read, create, and update tools for issues, accounts, and contacts. +After you add the source, C1 runs tool discovery against Pylon's MCP server. Discovered tools appear on the source's **Tools** tab and include Pylon's own search, read, create, and update tools for issues, accounts, and contacts. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Pylon tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -100,12 +100,12 @@ Pylon's REST API supports a single authentication method: a bearer token generat - You need access to generate an API token in Pylon, at **Settings → API Tokens** in the Pylon dashboard. -In your MCP server catalog, this option is listed as **Pylon API** — distinct from the **Pylon** entry, which connects to Pylon's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Pylon API** — distinct from the **Pylon** entry, which connects to Pylon's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Generate a Pylon API token -Generate the token in Pylon before registering the server in C1. +Generate the token in Pylon before adding the source in C1. @@ -121,13 +121,13 @@ Copy the token. Treat it as a high-value credential; Pylon only shows it once. For a shared production setup, generate the token from a dedicated service-account user so activity is attributable to C1 rather than a person. -## Register the server in C1 +## Add the source in C1 -With your API token ready, register the server and provide it to C1. +With your API token ready, add the source and provide it to C1. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Pylon API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Pylon API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your Pylon API token. @@ -143,9 +143,9 @@ Every user's tool calls use the one bearer token you provided, so Pylon sees a s ## Discover and govern tools -After you register the server, C1 runs tool discovery against Pylon. Discovered tools appear on the server's **Tools** tab and include issues, accounts, contacts, teams, users, knowledge bases, and tags. +After you add the source, C1 runs tool discovery against Pylon. Discovered tools appear on the source's **Tools** tab and include issues, accounts, contacts, teams, users, knowledge bases, and tags. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Pylon tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -155,7 +155,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Pylon API credentials -- **Rotate the token** by generating a new one at **Settings → API Tokens** in Pylon, then updating it on the server's authentication settings in C1. Revoke the old token in Pylon once the new one is in place. +- **Rotate the token** by generating a new one at **Settings → API Tokens** in Pylon, then updating it on the source's authentication settings in C1. Revoke the old token in Pylon once the new one is in place. - **Revoke access entirely** by deleting the token in Pylon; C1's calls will start failing until you provide a new one. diff --git a/product/admin/mcp-server/ramp.mdx b/product/admin/mcp-server/ramp.mdx index d9862df8..64d9bb96 100644 --- a/product/admin/mcp-server/ramp.mdx +++ b/product/admin/mcp-server/ramp.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Ramp MCP server -description: Connect Ramp to C1 with per-user OAuth or a shared OAuth2 service app, then register the Ramp MCP server and govern its tools. -og:title: Set up the Ramp MCP server -og:description: Connect Ramp to C1 with per-user OAuth or a shared OAuth2 service app, then register the Ramp MCP server and govern its tools. +title: Set up the Ramp MCP source +description: Connect Ramp to C1 with per-user OAuth or a shared OAuth2 service app, then add Ramp as a Catalog MCP source and govern its tools. +og:title: Set up the Ramp MCP source +og:description: Connect Ramp to C1 with per-user OAuth or a shared OAuth2 service app, then add Ramp as a Catalog MCP source and govern its tools. sidebarTitle: Ramp --- @@ -12,9 +12,9 @@ sidebarTitle: Ramp **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Ramp MCP server lets you govern access to Ramp — users, departments, cards, transactions, reimbursements, bills, and other spend data — as tools your AI clients can call through C1. +The Ramp Catalog MCP source lets you govern access to Ramp — users, departments, cards, transactions, reimbursements, bills, and other spend data — as tools your AI clients can call through C1. -Ramp authenticates with OAuth. You create a Ramp developer app, then choose how users connect when you register the server: +Ramp authenticates with OAuth. You create a Ramp developer app, then choose how users connect when you add the source: - **Per-user OAuth** (recommended). Each person authorizes with their own Ramp account, so every tool call runs under that user's Ramp identity and permissions. - **OAuth2 service mode**. A single shared app authenticates everyone, so all tool calls reach Ramp as one shared identity. @@ -33,7 +33,7 @@ The credentials you set up below are what C1 uses to call Ramp on your users' be - A Ramp account with permission to create developer apps, which typically requires an admin role. -If you don't see **Ramp** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Ramp** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Ramp developer app @@ -61,7 +61,7 @@ With per-user OAuth, you register one Ramp app and each user authorizes individu -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Ramp** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Ramp** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your app's **client ID** and **client secret**. @@ -77,7 +77,7 @@ A shared OAuth2 service app authenticates every user as one Ramp identity. Use t -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Ramp** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Ramp** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — service mode** and enter your app's **client ID** and **client secret**. @@ -94,13 +94,13 @@ How Ramp sees your users' activity depends on the method you chose: - **Per-user OAuth.** Each user authorizes with their own Ramp account, so tool calls run under that user's Ramp identity and inherit only the access they already have. Ramp attributes each action to the individual user. - **OAuth2 service mode.** Every user's tool calls use the one shared app you provided, so Ramp sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Ramp. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Ramp. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Ramp tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -110,5 +110,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Ramp credentials -- **Rotate the client secret** in your Ramp developer app, then update the secret on the server's authentication settings in C1. +- **Rotate the client secret** in your Ramp developer app, then update the secret on the source's authentication settings in C1. - **Adjust access** by editing the app's scopes in Ramp. diff --git a/product/admin/mcp-server/rapid7.mdx b/product/admin/mcp-server/rapid7.mdx index b9ce0bd7..21fee182 100644 --- a/product/admin/mcp-server/rapid7.mdx +++ b/product/admin/mcp-server/rapid7.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Rapid7 MCP server -description: Create a Rapid7 InsightVM API account, then register the Rapid7 MCP server in C1 and govern the tools your AI clients can call. -og:title: Set up the Rapid7 MCP server -og:description: Create a Rapid7 InsightVM API account, then register the Rapid7 MCP server in C1 and govern the tools your AI clients can call. +title: Set up the Rapid7 MCP source +description: Create a Rapid7 InsightVM API account, then add Rapid7 as a Catalog MCP source in C1 and govern the tools your AI clients can call. +og:title: Set up the Rapid7 MCP source +og:description: Create a Rapid7 InsightVM API account, then add Rapid7 as a Catalog MCP source in C1 and govern the tools your AI clients can call. sidebarTitle: Rapid7 --- @@ -12,7 +12,7 @@ sidebarTitle: Rapid7 **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Rapid7 MCP server lets you govern access to Rapid7 InsightVM — assets, vulnerabilities, scans, sites, and reports exposed by the InsightVM Security Console API — as tools your AI clients can call through C1. +The Rapid7 Catalog MCP source lets you govern access to Rapid7 InsightVM — assets, vulnerabilities, scans, sites, and reports exposed by the InsightVM Security Console API — as tools your AI clients can call through C1. Rapid7 InsightVM authenticates with a console username and password using HTTP basic auth. A single account authenticates every user, so all tool calls reach InsightVM as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Rapid7 on your users' - An InsightVM Security Console account with the permissions needed to read the assets and vulnerability data you want to govern, and network access to the console's API port (3780 by default). -If you don't see **Rapid7** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Rapid7** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Rapid7 InsightVM API account @@ -54,15 +54,15 @@ For a shared production setup, use a dedicated service account so activity is at The console account authenticates every user as one shared InsightVM identity, so InsightVM sees a single identity for all tool calls. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, create the credential from a dedicated service account so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Rapid7 MCP server in C1 +## Add the Rapid7 Catalog MCP source in C1 -With your console account ready, register the server and provide your credentials. +With your console account ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Rapid7** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Rapid7** from the catalog. Enter your InsightVM Security Console **host** (such as `nexpose.example.com`) and **port** (such as `3780`). @@ -77,9 +77,9 @@ Save your changes. C1 starts a sync that discovers the tools the Rapid7 server e ## Discover and govern tools -After you register the server, C1 runs tool discovery against Rapid7. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Rapid7. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Rapid7 tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -89,5 +89,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Rapid7 credentials -- **Rotate the password** on the InsightVM console user, then update the password on the server's authentication settings in C1. +- **Rotate the password** on the InsightVM console user, then update the password on the source's authentication settings in C1. - **Adjust access** by editing the roles and asset-group access granted to the console user in InsightVM. diff --git a/product/admin/mcp-server/salesforce.mdx b/product/admin/mcp-server/salesforce.mdx index 0da9cb17..3588301a 100644 --- a/product/admin/mcp-server/salesforce.mdx +++ b/product/admin/mcp-server/salesforce.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Salesforce MCP server -description: Connect Salesforce to C1 with per-user OAuth, then register the Salesforce MCP server and govern the tools it exposes. -og:title: Set up the Salesforce MCP server -og:description: Connect Salesforce to C1 with per-user OAuth, then register the Salesforce MCP server and govern the tools it exposes. +title: Set up the Salesforce MCP source +description: Connect Salesforce to C1 with per-user OAuth, then add Salesforce as a Catalog MCP source and govern the tools it exposes. +og:title: Set up the Salesforce MCP source +og:description: Connect Salesforce to C1 with per-user OAuth, then add Salesforce as a Catalog MCP source and govern the tools it exposes. sidebarTitle: Salesforce --- @@ -12,7 +12,7 @@ sidebarTitle: Salesforce **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Salesforce MCP server lets you govern access to the Salesforce Customer Platform — accounts, contacts, opportunities, custom objects, and the rest of the Salesforce data model — as tools your AI clients can call through C1. +The Salesforce Catalog MCP source lets you govern access to the Salesforce Customer Platform — accounts, contacts, opportunities, custom objects, and the rest of the Salesforce data model — as tools your AI clients can call through C1. Salesforce uses per-user OAuth, which is recommended: each person authorizes with their own Salesforce account, so every tool call runs under that user's identity and permissions. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Salesforce on your use - A Salesforce admin account that can create a connected app, typically the **System Administrator** profile or the **Customize Application** and **Modify All Data** permissions. -If you don't see **Salesforce** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Salesforce** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Salesforce connected app @@ -77,15 +77,15 @@ If your Salesforce org is a sandbox, use the sandbox login host when you authori With per-user OAuth, each user authorizes with their own Salesforce account, so tool calls run under that user's Salesforce identity and inherit only the access they already have. Salesforce attributes each action to the individual user. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Salesforce MCP server in C1 +## Add the Salesforce Catalog MCP source in C1 -With your connected app ready, register the server and provide your credentials. +With your connected app ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Salesforce** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Salesforce** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your connected app's **client ID** (Consumer Key) and **client secret** (Consumer Secret). @@ -97,9 +97,9 @@ Save your changes. The first time a user calls a Salesforce tool from their AI c ## Discover and govern tools -After you register the server, C1 runs tool discovery against Salesforce. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Salesforce. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Salesforce tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -109,5 +109,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Salesforce credentials -- **Rotate the consumer secret** in **App Manager** by opening your connected app and re-fetching its consumer details, then update the secret on the server's authentication settings in C1. +- **Rotate the consumer secret** in **App Manager** by opening your connected app and re-fetching its consumer details, then update the secret on the source's authentication settings in C1. - **Adjust access** by editing the connected app's OAuth scopes in Salesforce. diff --git a/product/admin/mcp-server/slack.mdx b/product/admin/mcp-server/slack.mdx index 3537f939..c1a93f14 100644 --- a/product/admin/mcp-server/slack.mdx +++ b/product/admin/mcp-server/slack.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Slack MCP server -description: Connect Slack to C1 through the Slack API or Slack's own hosted MCP server, then register the server and govern its tools. -og:title: Set up the Slack MCP server -og:description: Connect Slack to C1 through the Slack API or Slack's own hosted MCP server, then register the server and govern its tools. +title: Set up the Slack MCP source +description: Connect Slack to C1 through the Slack API or Slack's own hosted MCP server, then add the Catalog MCP source and govern its tools. +og:title: Set up the Slack MCP source +og:description: Connect Slack to C1 through the Slack API or Slack's own hosted MCP server, then add the Catalog MCP source and govern its tools. sidebarTitle: Slack --- @@ -12,9 +12,9 @@ sidebarTitle: Slack **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -C1 can govern Slack access two ways. Both let your AI clients read from and act on Slack through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog: +C1 can govern Slack access two ways. Both let your AI clients read from and act on Slack through governed MCP tools, but they come from different places and appear as two separate entries in your MCP source catalog: -- **Slack MCP** — listed as plain **Slack** in your catalog. C1 registers Slack's own hosted MCP server (`mcp.slack.com`) as a downstream server C1 governs. Authentication uses Slack's dedicated user-token OAuth flow: an admin registers a Slack app and provides its client ID and secret to C1 (there's no dynamic client registration), then each user authorizes individually. A static Slack user token is also supported as a bearer fallback. Tool calls run with the connected user's **User Token Scopes** — never a bot identity. +- **Slack MCP** — listed as plain **Slack** in your catalog. C1 adds Slack's own hosted MCP server (`mcp.slack.com`) as a Catalog MCP source. Authentication uses Slack's dedicated user-token OAuth flow: an admin registers a Slack app and provides its client ID and secret to C1 (there's no dynamic client registration), then each user authorizes individually. A static Slack user token is also supported as a bearer fallback. Tool calls run with the connected user's **User Token Scopes** — never a bot identity. - **Slack API** — C1 hosts its own MCP server that translates the Slack API into tools. You authorize with per-user OAuth using a Slack app's client ID and secret, and scope access with the **User Token Scopes** you configure. | | Slack MCP | Slack API | @@ -23,7 +23,7 @@ C1 can govern Slack access two ways. Both let your AI clients read from and act | **Authentication** | Slack's user-token OAuth flow via a Slack app you register (client ID/secret; no dynamic client registration) — or a static user token as a bearer fallback | Per-user OAuth via a Slack app's client ID/secret | | **Access scoping** | The **User Token Scopes** you request on the Slack app | The **User Token Scopes** you configure | | **Tool surface** | Slack's own tool set exposed by its hosted MCP server | Channels, messages, users, files, and search, mapped to Slack API endpoints | -| **Setup effort** | Create a Slack app, turn on its **Slack Model Context Protocol (MCP) Server** toggle, configure the user-token OAuth flow (or a static token), then register in C1 | Create a Slack app, configure user token scopes, then register in C1 | +| **Setup effort** | Create a Slack app, turn on its **Slack Model Context Protocol (MCP) Server** toggle, configure the user-token OAuth flow (or a static token), then add the source in C1 | Create a Slack app, configure user token scopes, then add the source in C1 | Use the native **Slack MCP** option (listed as plain **Slack** in your catalog) if you want Slack's own hosted tool set and can register a Slack app for its user-token OAuth flow (or a static token). Use **Slack API** if you'd rather use C1's own Slack integration with the scopes-based setup you're already familiar with. @@ -40,7 +40,7 @@ C1 registers as a client of Slack's own hosted MCP server ([Slack MCP server](ht - Only a **directory-published** or **internal** Slack app can use the hosted MCP server — see Step 3 below. -In your MCP server catalog, this option is listed as **Slack** — distinct from the **Slack API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Slack** — distinct from the **Slack API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Slack app for MCP @@ -112,7 +112,7 @@ In the app settings sidebar, open **Features** > **Agents**. Under **Slack Model Leave the **Agent experience** toggle on the same page off. It's a separate Slack feature for conversational agents, and the MCP server doesn't require it. -Make the app eligible to use the MCP server: either submit it to the Slack Marketplace (directory-published), or have a workspace admin install it as an internal app. Keep the app ID fixed once you've registered it in C1, since C1's connection pins to it. +Make the app eligible to use the MCP server: either submit it to the Slack Marketplace (directory-published), or have a workspace admin install it as an internal app. Keep the app ID fixed once you've added the source in C1, since C1's connection pins to it. @@ -151,7 +151,7 @@ If you created the app from scratch, add them now: under **Redirect URLs**, sele In the left sidebar, open **Basic Information**. Under **App Credentials**, copy the **Client ID**, then reveal and copy the **Client Secret**. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Slack** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Slack** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enter your app's **client ID** and **client secret**, plus the scopes you configured. @@ -173,7 +173,7 @@ Create the app from the [manifest above](#create-a-slack-app-for-mcp) — or, on Install the app to the workspace, then copy the **User OAuth Token** (`xoxp-…`) from that page. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Slack** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Slack** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste the user token. @@ -196,13 +196,13 @@ How Slack sees your users' activity depends on the method you chose: - **Per-user OAuth (recommended).** Each user authorizes with their own Slack account, so tool calls run under that user's Slack user-token identity, scoped to the User Token Scopes you configured. Slack attributes each action to the individual user. - **Static user token (Bearer).** Every user's tool calls use the one token you provided, so Slack sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Slack's MCP server. Discovered tools appear on the server's **Tools** tab and are exactly the ones Slack's own MCP server exposes. +After you add the source, C1 runs tool discovery against Slack's MCP server. Discovered tools appear on the source's **Tools** tab and are exactly the ones Slack's own MCP server exposes. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Slack tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -212,7 +212,7 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove ## Manage access to Slack MCP -- **Rotate the client secret** on the app's **Basic Information** page under **App Credentials**, then update the secret on the server's authentication settings in C1. +- **Rotate the client secret** on the app's **Basic Information** page under **App Credentials**, then update the secret on the source's authentication settings in C1. - **Rotate a static user token** by reinstalling the app in Slack to regenerate the **User OAuth Token**, then update it in C1. - **Revoke access** by uninstalling the Slack app from the workspace on **OAuth & Permissions**, or by turning off the app's **Slack Model Context Protocol (MCP) Server** toggle under **Features** > **Agents**. - **Adjust access** by editing the app's **User Token Scopes** on the **OAuth & Permissions** page in Slack. @@ -221,7 +221,7 @@ Tool discovery runs even if authentication isn't complete yet, so seeing discove -The Slack MCP server lets you govern access to Slack — channels, messages, users, files, and search — as tools your AI clients can call through C1. +The Slack Catalog MCP source lets you govern access to Slack — channels, messages, users, files, and search — as tools your AI clients can call through C1. Slack uses per-user OAuth, which is recommended: each person authorizes with their own Slack account, so every tool call runs under that user's identity and permissions. @@ -237,7 +237,7 @@ The credentials you set up below are what C1 uses to call Slack on your users' b - Permission to create and configure a Slack app. See Slack's [guide to installing apps with OAuth](https://docs.slack.dev/authentication/installing-with-oauth/). -In your MCP server catalog, this option is listed as **Slack API** — distinct from the **Slack** entry, which connects to Slack's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +In your MCP source catalog, this option is listed as **Slack API** — distinct from the **Slack** entry, which connects to Slack's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Slack app @@ -331,15 +331,15 @@ Scope changes take effect the next time a user connects. If you add an optional With per-user OAuth, each user authorizes with their own Slack account, so tool calls run under that user's Slack identity and inherit only the access they already have. Slack attributes each action to the individual user. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Slack MCP server in C1 +## Add the Slack Catalog MCP source in C1 -Register the server in C1 and connect it to the Slack app you created. +Add the source in C1 and connect it to the Slack app you created. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Slack API** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Slack API** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose per-user OAuth and enter your app's **client ID** and **client secret**, plus the scopes you configured (see [Slack scopes](#slack-scopes)). @@ -351,9 +351,9 @@ Save your changes. The first time a user calls a Slack tool from their AI client ## Discover and govern tools -After you register the server, C1 runs tool discovery against Slack. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Slack. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Slack tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -363,7 +363,7 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Slack credentials -- **Rotate the client secret** on the app's **Basic Information** page under **App Credentials**, then update the secret on the server's authentication settings in C1. +- **Rotate the client secret** on the app's **Basic Information** page under **App Credentials**, then update the secret on the source's authentication settings in C1. - **Adjust access** by editing the app's **User Token Scopes** on the **OAuth & Permissions** page in Slack. diff --git a/product/admin/mcp-server/snowflake.mdx b/product/admin/mcp-server/snowflake.mdx index 095e1e67..47d2c6b7 100644 --- a/product/admin/mcp-server/snowflake.mdx +++ b/product/admin/mcp-server/snowflake.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Snowflake MCP server -description: Create a Snowflake role, connect with per-user OAuth or a programmatic access token, and register the Snowflake MCP servers so your AI clients query Snowflake through governed tools. -og:title: Set up the Snowflake MCP server -og:description: Create a Snowflake role, connect with per-user OAuth or a programmatic access token, and register the Snowflake MCP servers so your AI clients query Snowflake through governed tools. +title: Set up the Snowflake MCP source +description: Create a Snowflake role, connect with per-user OAuth or a programmatic access token, and add the Snowflake Catalog MCP sources so your AI clients query Snowflake through governed tools. +og:title: Set up the Snowflake MCP source +og:description: Create a Snowflake role, connect with per-user OAuth or a programmatic access token, and add the Snowflake Catalog MCP sources so your AI clients query Snowflake through governed tools. sidebarTitle: Snowflake --- @@ -13,19 +13,19 @@ sidebarTitle: Snowflake -**Early access.** The Snowflake MCP servers are in early access while we gather feedback. If your Snowflake setup differs from what this guide describes, [contact the C1 support team](mailto:support@c1.ai). +**Early access.** The Snowflake Catalog MCP sources are in early access while we gather feedback. If your Snowflake setup differs from what this guide describes, [contact the C1 support team](mailto:support@c1.ai). -The Snowflake MCP servers let you govern access to your Snowflake account — running SQL statements, inspecting databases, schemas, tables, and warehouses, and using Cortex AI features — as tools your AI clients call through C1. +The Snowflake Catalog MCP sources let you govern access to your Snowflake account — running SQL statements, inspecting databases, schemas, tables, and warehouses, and using Cortex AI features — as tools your AI clients call through C1. -C1 publishes several Snowflake servers, and they all connect the same way: +C1 offers several Snowflake Catalog MCP sources, and they all connect the same way: - **Snowflake (Data)** — run SQL statements and inspect schemas, tables, databases, and warehouses. - **Snowflake (Admin)** — manage accounts, databases, and warehouses. - **Snowflake Cortex** — Cortex Analyst natural-language questions over governed data, and Cortex Search. - **Snowflake Cortex Inference** — the Cortex large language model completion API. -Set up the Snowflake side once, then register each server you want to use. +Set up the Snowflake side once, then add each source you want to use. ## How C1 connects to Snowflake @@ -110,7 +110,7 @@ GRANT ROLE c1_mcp_role TO USER jsmith; -Your Snowflake OAuth security integration is ready. Keep the client ID and secret for [Register the server with OAuth](#register-the-server-with-oauth). +Your Snowflake OAuth security integration is ready. Keep the client ID and secret for [Add the source with OAuth](#add-the-source-with-oauth). `OAUTH_REFRESH_TOKEN_VALIDITY` is measured in seconds. For a custom client, Snowflake accepts 86400 seconds (1 day) through 7776000 seconds (90 days), and defaults to 90 days. When the refresh token expires, users reconnect their Snowflake account. @@ -118,13 +118,13 @@ Your Snowflake OAuth security integration is ready. Keep the client ID and secre Snowflake prevents the ACCOUNTADMIN, ORGADMIN, GLOBALORGADMIN, and SECURITYADMIN roles from authenticating over OAuth by default. Authorizing as one of those roles fails, which is a common first-time setup problem. Use a purpose-built role instead. To change this behavior, an account administrator sets the `OAUTH_ADD_PRIVILEGED_ROLES_TO_BLOCKED_LIST` account parameter to `FALSE`, which we do not recommend for an AI integration. See [CREATE SECURITY INTEGRATION](https://docs.snowflake.com/en/sql-reference/sql/create-security-integration-oauth-snowflake). -## Register the server with OAuth +## Add the source with OAuth -With your Snowflake role and OAuth security integration ready, register the server and provide your credentials. +With your Snowflake role and OAuth security integration ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select the Snowflake server you want from the catalog, such as **Snowflake (Data)**. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select the Snowflake source you want from the catalog, such as **Snowflake (Data)**. Enter your **Snowflake account URL**, such as `https://myorg-myaccount.snowflakecomputing.com`. @@ -198,15 +198,15 @@ Copy the token value when Snowflake displays it. You cannot retrieve it again. S -Your service user and token are ready. Keep the token value for [Register the server with a token](#register-the-server-with-a-token). +Your service user and token are ready. Keep the token value for [Add the source with a token](#add-the-source-with-a-token). -## Register the server with a token +## Add the source with a token -With your service user and token ready, register the server and provide your credentials. +With your service user and token ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select the Snowflake server you want from the catalog, such as **Snowflake (Data)**. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select the Snowflake source you want from the catalog, such as **Snowflake (Data)**. Enter your **Snowflake account URL**, such as `https://myorg-myaccount.snowflakecomputing.com`. @@ -231,7 +231,7 @@ Every user's tool calls use the one token you provided, so Snowflake sees a sing ## Manage your token credentials -- **Rotate the token.** Generate a replacement token, update the server's credentials in C1, then remove the old token in Snowflake. +- **Rotate the token.** Generate a replacement token, update the source's credentials in C1, then remove the old token in Snowflake. - **Change what tools can reach.** Adjust the grants on `c1_mcp_role`. Tools return Snowflake's own permission error when the role lacks a privilege. - **Revoke access.** Remove the token from the user in Snowflake, or disable the service user. - **Plan for expiry.** The token stops working at `DAYS_TO_EXPIRY`. Tool calls fail until you issue a replacement and update the credentials in C1. @@ -242,9 +242,9 @@ Every user's tool calls use the one token you provided, so Snowflake sees a sing ## Discover and govern tools -After you register the server, C1 runs tool discovery against Snowflake. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Snowflake. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Snowflake tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/statuspage.mdx b/product/admin/mcp-server/statuspage.mdx index 2281cceb..9336f693 100644 --- a/product/admin/mcp-server/statuspage.mdx +++ b/product/admin/mcp-server/statuspage.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Statuspage MCP server -description: Create a Statuspage API key, then register the Statuspage MCP server in C1 and govern the tools it exposes. -og:title: Set up the Statuspage MCP server -og:description: Create a Statuspage API key, then register the Statuspage MCP server in C1 and govern the tools it exposes. +title: Set up the Statuspage MCP source +description: Create a Statuspage API key, then add Statuspage as a Catalog MCP source in C1 and govern the tools it exposes. +og:title: Set up the Statuspage MCP source +og:description: Create a Statuspage API key, then add Statuspage as a Catalog MCP source in C1 and govern the tools it exposes. sidebarTitle: Statuspage --- @@ -12,7 +12,7 @@ sidebarTitle: Statuspage **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Statuspage MCP server lets you govern access to Statuspage — pages, components, incidents, maintenances, metrics, and subscribers — as tools your AI clients can call through C1. +The Statuspage Catalog MCP source lets you govern access to Statuspage — pages, components, incidents, maintenances, metrics, and subscribers — as tools your AI clients can call through C1. Statuspage authenticates with an API key. A single key authenticates everyone, so all tool calls reach Statuspage as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Statuspage on your use - A Statuspage account with access to the pages you want to govern and permission to create an API key. -If you don't see **Statuspage** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Statuspage** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Statuspage API key @@ -53,15 +53,15 @@ For a shared production setup, create the API key from a dedicated service accou Every user's tool calls use the one API key you provided, so Statuspage sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated service account so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Statuspage MCP server in C1 +## Add the Statuspage Catalog MCP source in C1 -With your API key ready, register the server and provide your credentials. +With your API key ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Statuspage** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Statuspage** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Custom header**. Set the header name to `Authorization` and the value to `OAuth ` followed by your API key (for example, `OAuth abc123`). @@ -73,9 +73,9 @@ Save your changes. C1 starts a sync that discovers the tools the Statuspage serv ## Discover and govern tools -After you register the server, C1 runs tool discovery against Statuspage. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Statuspage. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Statuspage tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/tableau.mdx b/product/admin/mcp-server/tableau.mdx index cab4508b..2df6affb 100644 --- a/product/admin/mcp-server/tableau.mdx +++ b/product/admin/mcp-server/tableau.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Tableau MCP server -description: Create a Tableau session token from a personal access token, then register the Tableau MCP server in C1 and govern its tools. -og:title: Set up the Tableau MCP server -og:description: Create a Tableau session token from a personal access token, then register the Tableau MCP server in C1 and govern its tools. +title: Set up the Tableau MCP source +description: Create a Tableau session token from a personal access token, then add Tableau as a Catalog MCP source in C1 and govern its tools. +og:title: Set up the Tableau MCP source +og:description: Create a Tableau session token from a personal access token, then add Tableau as a Catalog MCP source in C1 and govern its tools. sidebarTitle: Tableau --- @@ -12,7 +12,7 @@ sidebarTitle: Tableau **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Tableau MCP server lets you govern access to Tableau Cloud and Tableau Server — workbooks, data sources, projects, users, groups, sites, schedules, and subscriptions — as tools your AI clients can call through C1. +The Tableau Catalog MCP source lets you govern access to Tableau Cloud and Tableau Server — workbooks, data sources, projects, users, groups, sites, schedules, and subscriptions — as tools your AI clients can call through C1. Tableau authenticates with a session token that C1 sends in the `X-Tableau-Auth` header. You generate the session token from a Tableau personal access token (PAT). A single token authenticates everyone, so all tool calls reach Tableau as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Tableau on your users' - A Tableau user with the site role needed for the operations C1 should perform. Use a **Site Administrator Creator** for full admin coverage, or a narrower Explorer or Viewer role for reads only. For a shared production setup, create a dedicated Tableau service-account user and generate the PAT from that account. -If you don't see **Tableau** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Tableau** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Generate a Tableau personal access token @@ -85,15 +85,15 @@ A session token expires after about 4 hours, or 15 days of inactivity. The PAT i Every user's tool calls use the one session token you provided, so Tableau sees a single shared identity, scoped to the site role of the user whose PAT produced the token. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared production setup, generate the PAT from a dedicated service-account user so Tableau activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Tableau MCP server in C1 +## Add the Tableau Catalog MCP source in C1 -With your session token and site details ready, register the server and provide your credentials. +With your session token and site details ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Tableau** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Tableau** from the catalog. Enter your **instance URL**, such as `https://10ay.online.tableau.com`, and your **site LUID** from the sign-in response. @@ -108,9 +108,9 @@ Save your changes. C1 starts a sync that discovers the tools the Tableau server ## Discover and govern tools -After you register the server, C1 runs tool discovery against Tableau. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Tableau. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Tableau tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/trello.mdx b/product/admin/mcp-server/trello.mdx index 31ef0561..a5779352 100644 --- a/product/admin/mcp-server/trello.mdx +++ b/product/admin/mcp-server/trello.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Trello MCP server -description: Create a Trello API key and token, then register the Trello MCP server in C1 and govern the tools it exposes. -og:title: Set up the Trello MCP server -og:description: Create a Trello API key and token, then register the Trello MCP server in C1 and govern the tools it exposes. +title: Set up the Trello MCP source +description: Create a Trello API key and token, then add Trello as a Catalog MCP source in C1 and govern the tools it exposes. +og:title: Set up the Trello MCP source +og:description: Create a Trello API key and token, then add Trello as a Catalog MCP source in C1 and govern the tools it exposes. sidebarTitle: Trello --- @@ -12,7 +12,7 @@ sidebarTitle: Trello **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Trello MCP server lets you govern access to Trello — boards, lists, cards, members, and organizations — as tools your AI clients call through C1. +The Trello Catalog MCP source lets you govern access to Trello — boards, lists, cards, members, and organizations — as tools your AI clients call through C1. Trello authenticates with an API key paired with a token. The token is authorized against a single Trello account, so all tool calls reach Trello as one shared identity. @@ -28,7 +28,7 @@ The credentials you set up below are what C1 uses to call Trello on your users' - A Trello account that can create a Power-Up to obtain an API key, and that can authorize a token carrying the access you want to govern. -If you don't see **Trello** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Trello** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Trello API key and token @@ -53,15 +53,15 @@ For a shared production setup, authorize the token from a dedicated service-acco Every user's tool calls use the one API key and token you provided, so Trello sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, authorize the token from a dedicated service-account user so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Trello MCP server in C1 +## Add the Trello Catalog MCP source in C1 -With your API key and token ready, register the server and provide your credentials. +With your API key and token ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Trello** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Trello** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Custom header** and enter your Trello **API key** and **token** in the fields provided. @@ -73,9 +73,9 @@ Save your changes. C1 starts a sync that discovers the tools the Trello server e ## Discover and govern tools -After you register the server, C1 runs tool discovery against Trello. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Trello. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Trello tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/vectara.mdx b/product/admin/mcp-server/vectara.mdx index 10f6cb40..22d7fd3a 100644 --- a/product/admin/mcp-server/vectara.mdx +++ b/product/admin/mcp-server/vectara.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Vectara MCP server -description: Create a Vectara API key or OAuth app credentials, then register the Vectara MCP server in C1 and govern its tools. -og:title: Set up the Vectara MCP server -og:description: Create a Vectara API key or OAuth app credentials, then register the Vectara MCP server in C1 and govern its tools. +title: Set up the Vectara MCP source +description: Create a Vectara API key or OAuth app credentials, then add Vectara as a Catalog MCP source in C1 and govern its tools. +og:title: Set up the Vectara MCP source +og:description: Create a Vectara API key or OAuth app credentials, then add Vectara as a Catalog MCP source in C1 and govern its tools. sidebarTitle: Vectara --- @@ -12,9 +12,9 @@ sidebarTitle: Vectara **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Vectara MCP server lets you govern access to Vectara — corpora, documents, queries, and account data — as tools your AI clients can call through C1. +The Vectara Catalog MCP source lets you govern access to Vectara — corpora, documents, queries, and account data — as tools your AI clients can call through C1. -Vectara supports two ways to authenticate, and you choose one when you register the server: +Vectara supports two ways to authenticate, and you choose one when you add the source: - **API key** (recommended for most setups). A single key authenticates everyone, so all tool calls reach Vectara as one shared identity. - **OAuth2 client credentials**. C1 exchanges an app client ID and secret for a short-lived access token. A single app authenticates everyone, so all tool calls reach Vectara as one shared identity. @@ -33,7 +33,7 @@ The credentials you set up below are what C1 uses to call Vectara on your users' - A Vectara account that can create API keys or OAuth app credentials, scoped to the corpora you want to govern. -If you don't see **Vectara** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Vectara** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Option 1: Use an API key @@ -58,13 +58,13 @@ Copy the key. Vectara shows the key only once. For a shared production setup, scope the key to only the corpora and access level you want to govern so activity is attributable to C1 rather than a person. -### Register the server with an API key +### Add the source with an API key -With your API key ready, register the server and provide your credentials. +With your API key ready, add the source and provide your credentials. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Vectara** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Vectara** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Custom header**. Set the header name to `x-api-key` and the value to your Vectara API key. @@ -96,13 +96,13 @@ Copy the **Client ID** and **Client Secret**. Vectara shows the client secret on For a shared production setup, scope the app to only the corpora and access level you want to govern so activity is attributable to C1 rather than a person. -### Register the server with OAuth2 client credentials +### Add the source with OAuth2 client credentials -With your app credentials ready, register the server and provide them. +With your app credentials ready, add the source and provide them. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Vectara** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Vectara** from the catalog. When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — client credentials** and enter your app's **client ID** and **client secret**. @@ -121,13 +121,13 @@ Both authentication methods use one shared identity: With either method, C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, scope the credential to a dedicated identity so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). ## Discover and govern tools -After you register the server, C1 runs tool discovery against Vectara. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Vectara. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Vectara tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/wiz.mdx b/product/admin/mcp-server/wiz.mdx index c56642eb..b475d7b3 100644 --- a/product/admin/mcp-server/wiz.mdx +++ b/product/admin/mcp-server/wiz.mdx @@ -1,8 +1,8 @@ --- -title: Set up the Wiz MCP server -description: Create a Wiz service account, then register the Wiz MCP server in C1 and govern the tools your AI clients can call. -og:title: Set up the Wiz MCP server -og:description: Create a Wiz service account, then register the Wiz MCP server in C1 and govern the tools your AI clients can call. +title: Set up the Wiz MCP source +description: Create a Wiz service account, then add Wiz as a Catalog MCP source in C1 and govern the tools your AI clients can call. +og:title: Set up the Wiz MCP source +og:description: Create a Wiz service account, then add Wiz as a Catalog MCP source in C1 and govern the tools your AI clients can call. sidebarTitle: Wiz --- @@ -12,7 +12,7 @@ sidebarTitle: Wiz **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -The Wiz MCP server lets you govern access to the Wiz cloud security platform — issues, vulnerabilities, cloud resources, and other data exposed by the Wiz GraphQL API — as tools your AI clients can call through C1. +The Wiz Catalog MCP source lets you govern access to the Wiz cloud security platform — issues, vulnerabilities, cloud resources, and other data exposed by the Wiz GraphQL API — as tools your AI clients can call through C1. Wiz authenticates with a service account using the OAuth2 client credentials flow. The service account's client ID and client secret authenticate every user, so all tool calls reach Wiz as one shared identity. @@ -29,7 +29,7 @@ The credentials you set up below are what C1 uses to call Wiz on your users' beh - Your regional Wiz API endpoint, such as `https://api.us1.app.wiz.io`. -If you don't see **Wiz** in your MCP server catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. +If you don't see **Wiz** in your MCP source catalog, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant. ## Create a Wiz service account @@ -55,15 +55,15 @@ For a shared production setup, use a dedicated service account so activity is at The service account authenticates every user as one shared Wiz identity, so Wiz sees a single identity for all tool calls. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated service account so activity is attributable to C1 rather than a person. -For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). +For how shared and per-user credentials work across MCP sources, see [Configure authentication](/product/admin/mcp-servers#configure-authentication). -## Register the Wiz MCP server in C1 +## Add the Wiz Catalog MCP source in C1 -With your service account credentials ready, register the server and provide them. +With your service account credentials ready, add the source and provide them. -Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Wiz** from the catalog. +Follow [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) and select **Wiz** from the catalog. Enter your regional Wiz API endpoint, such as `https://api.us1.app.wiz.io`. @@ -78,9 +78,9 @@ Save your changes. C1 starts a sync that discovers the tools the Wiz server expo ## Discover and govern tools -After you register the server, C1 runs tool discovery against Wiz. Discovered tools appear on the server's **Tools** tab. +After you add the source, C1 runs tool discovery against Wiz. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCPs** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Wiz tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -90,5 +90,5 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your Wiz credentials -- **Rotate the client secret** by rotating the service account's secret in Wiz, then update the secret on the server's authentication settings in C1. +- **Rotate the client secret** by rotating the service account's secret in Wiz, then update the secret on the source's authentication settings in C1. - **Adjust access** by editing the scopes granted to the service account in Wiz. diff --git a/product/admin/mcp-servers.mdx b/product/admin/mcp-servers.mdx index a0c4ce55..2b5cbff0 100644 --- a/product/admin/mcp-servers.mdx +++ b/product/admin/mcp-servers.mdx @@ -1,8 +1,8 @@ --- -title: Set up an MCP server -description: Register an MCP server with C1, link it to a C1 application, and configure authentication so C1 can govern access to its tools and resources. -og:title: Set up an MCP server - C1 docs -og:description: Register an MCP server with C1, link it to a C1 application, and configure authentication so C1 can govern access to its tools and resources. +title: Set up an MCP source +description: Add an MCP source to C1, link it to a C1 application, and configure authentication so C1 can govern access to its tools and resources. +og:title: Set up an MCP source - C1 docs +og:description: Add an MCP source to C1, link it to a C1 application, and configure authentication so C1 can govern access to its tools and resources. --- {/* Editor Refresh: 2026-05-29 */} @@ -11,49 +11,49 @@ og:description: Register an MCP server with C1, link it to a C1 application, and **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -This page walks through registering an MCP server with C1, linking it to a C1 application, and configuring authentication. Once registered, C1 discovers the tools and resources the server exposes. See [Govern tools and toolsets](/product/admin/tools-and-toolsets) and [Govern MCP resources](/product/admin/mcp-resources) for what to do next. +This page walks through adding an MCP source to C1, linking it to a C1 application, and configuring authentication. Once added, C1 discovers the tools and resources the source exposes. See [Govern tools and toolsets](/product/admin/tools-and-toolsets) and [Govern MCP resources](/product/admin/mcp-resources) for what to do next. ## Before you begin - AIAM must be enabled for the tenant. See [Enable AI access management](/product/admin/enable-ai-access-management). -- For OAuth-based auth, you'll need a client ID and secret from the downstream service — unless the server supports OAuth Dynamic Client Registration (DCR), in which case C1 registers itself automatically and no credentials are required. +- For OAuth-based auth, you'll need a client ID and secret from the downstream service — unless the source's MCP server supports OAuth Dynamic Client Registration (DCR), in which case C1 registers itself automatically and no credentials are required. - For per-user OAuth, the downstream service must be reachable by C1's hosted callback URL. -## Register an MCP server +## Add an MCP source -C1 walks you through registering an MCP server one question at a time, whether you start from the catalog or from a custom URL: +C1 walks you through adding an MCP source one question at a time, whether you choose a source from the catalog or provide an external URL: -In C1, go to **AI > MCPs** and click **Connect MCP server**. +In C1, go to **AI > Sources** and click **Add MCP source**. -Choose the server from the catalog shortlist (or browse the full catalog grid), or enter a custom URL. +Choose a Catalog MCP source from the shortlist or browse all available sources, or add an External MCP source using a custom URL. -Answer the setup questions as they appear: where the server is hosted (public or through a bridge), the server URL, who should be able to use it and when, and what happens to newly discovered tools. +Answer the setup questions as they appear: where the source's MCP server is hosted (public or through a bridge), the server URL, who should be able to use it and when, and what happens to newly discovered tools. -Confirm authentication. C1 probes the server's OAuth configuration automatically — a self-registering (DCR) server asks nothing further here. Otherwise, choose an auth method; see [Configure authentication](#configure-authentication) for what each one needs. +Confirm authentication. C1 probes the MCP server's OAuth configuration automatically — a self-registering (DCR) server asks nothing further here. Otherwise, choose an auth method; see [Configure authentication](#configure-authentication) for what each one needs. -Review and submit. C1 registers the server and runs initial discovery. +Review and submit. C1 adds the source and runs initial discovery. -**Access profile selection isn't applied yet.** The guided flow lets you choose an access profile during setup, but that selection currently isn't bound to the server at registration — it's recorded but not enforced. Assign an access profile afterward from the server's settings, or through [Govern tools and toolsets](/product/admin/tools-and-toolsets), rather than relying on the in-flow selection. +**Access profile selection isn't applied yet.** The guided flow lets you choose an access profile during setup, but that selection currently isn't bound to the source — it's recorded but not enforced. Assign an access profile afterward from the source's settings, or through [Govern tools and toolsets](/product/admin/tools-and-toolsets), rather than relying on the in-flow selection. -After registration, the server appears in **AI > MCPs**. Its discovered tools are listed on the **Tools** tab. If the server exposes resources, they are listed on the **Resources** tab. You can sort the **Tools** tab by tool name, visibility, classification, state, and last updated. +After setup, the source appears in **AI > Sources**. Its discovered tools are listed on the **Tools** tab. If the source exposes resources, they are listed on the **Resources** tab. You can sort the **Tools** tab by tool name, visibility, classification, state, and last updated. -The server's URL can't be changed once it completes its first successful sync. To point at a different endpoint, register a new MCP server instead. +The source's URL can't be changed once it completes its first successful sync. To point at a different endpoint, add a new MCP source instead. ## Configure authentication -C1 supports multiple auth methods for downstream MCP servers. Admins can select any supported method when configuring a server. +C1 supports multiple auth methods for downstream MCP servers. Admins can select any supported method when configuring a source. | Method | Who the downstream sees | When to use | | :--- | :--- | :--- | @@ -71,7 +71,7 @@ To configure auth: -From the registered server's settings, click **Edit authentication**. +From the MCP source's settings, click **Edit authentication**. Select the auth method. @@ -86,32 +86,32 @@ Enter the required credentials for the selected method: - **Per-user (each user submits their own)**: No credentials to enter. Each user provides their own username and password when they connect, and MCP requests run under their individual identity. - **Client credentials** — enter client ID, client secret, and token URL. - **Service mode** — enter client ID, client secret, authorization URL, token URL, and scopes. An admin completes the OAuth flow once; all users share that credential. -- **Per-user passthrough** — enter client ID, client secret, authorization URL, token URL, and scopes. End users see a Connect prompt the first time their AI client calls a tool from this server. +- **Per-user passthrough** — enter client ID, client secret, authorization URL, token URL, and scopes. End users see a Connect prompt the first time their AI client calls a tool from this source. - **JWT bearer** — enter the issuer, private key, subject, audience, token URL, and scopes. -If the server supports OAuth Dynamic Client Registration (DCR), you can skip entering a client ID and secret entirely. Toggle on **Use dynamic client registration** — C1 registers itself with the server's authorization server automatically. +If the source's MCP server supports OAuth Dynamic Client Registration (DCR), you can skip entering a client ID and secret entirely. Toggle on **Use dynamic client registration** — C1 registers itself with the server's authorization server automatically. -Before registering, C1 runs a discovery check against the server's authorization server. If discovery finds an issue that can be relaxed — such as an issuer mismatch or an authorization server on a different host — C1 shows you the finding and asks you to acknowledge it before registration continues. Findings that can't be safely relaxed block registration entirely. +Before adding the source, C1 runs a discovery check against the server's authorization server. If discovery finds an issue that can be relaxed — such as an issuer mismatch or an authorization server on a different host — C1 shows you the finding and asks you to acknowledge it before setup continues. Findings that can't be safely relaxed block setup entirely. Click **Save**. C1 makes a test call to validate the credentials. -## Configure server settings +## Configure source settings | Setting | Required? | What it does | | :--- | :--- | :--- | | **Authentication** | Required | See above | -| **Data sensitivity** | Optional | Metadata tag on the server (low / medium / high). Surfaces in the catalog and audit log; no enforcement | -| **Tool prefix** | Optional; required if multiple servers under one app | Prepended to tool names so AI clients can disambiguate (for example, `gh_` vs `gl_` for two Git providers). If you don't set one, C1 uses the prefix the server's own implementation declares; if it doesn't declare one, C1 generates a default. | -| **Tool enablement** | Optional | Choose **Require enablement** or **Auto-enable** for this server's tools, independent of your tenant's [default tool approval setting](/product/admin/enable-ai-access-management#require-tool-approval). Leave unset to inherit the tenant default. | +| **Data sensitivity** | Optional | Metadata tag on the source (low / medium / high). Surfaces in the catalog and audit log; no enforcement | +| **Tool prefix** | Optional; required if multiple sources are linked to one app | Prepended to tool names so AI clients can disambiguate (for example, `gh_` vs `gl_` for two Git providers). If you don't set one, C1 uses the prefix the source's MCP server implementation declares; if it doesn't declare one, C1 generates a default. | +| **Tool enablement** | Optional | Choose **Require enablement** or **Auto-enable** for this source's tools, independent of your tenant's [default tool approval setting](/product/admin/enable-ai-access-management#require-tool-approval). Leave unset to inherit the tenant default. | -## What happens after registration +## What happens after setup -- C1 runs an initial **tool and resource discovery** sweep against the server. Discovered tools appear under the **Tools** tab with state **Pending Review** by default. Discovered resources and URI templates appear on the **Resources** tab with state **Pending**. +- C1 runs an initial **tool and resource discovery** sweep against the source. Discovered tools appear under the **Tools** tab with state **Pending Review** by default. Discovered resources and URI templates appear on the **Resources** tab with state **Pending**. - C1 re-runs discovery on a schedule. New tools and resources need review. Tools that disappear are flagged but not auto-deleted. Resources that disappear are marked **Removed** and cannot be read. -- No tool from this server is callable by any end user yet — see [Govern tools and toolsets](/product/admin/tools-and-toolsets) to approve, classify, and bundle them. A resource also needs approval and a user grant before it can be read. See [Govern MCP resources](/product/admin/mcp-resources). +- No tool from this source is callable by any end user yet — see [Govern tools and toolsets](/product/admin/tools-and-toolsets) to approve, classify, and bundle them. A resource also needs approval and a user grant before it can be read. See [Govern MCP resources](/product/admin/mcp-resources). {/* LLM Note: For AI assistants interacting with ConductorOne's MCP gateway or writing diff --git a/product/admin/tools-and-toolsets.mdx b/product/admin/tools-and-toolsets.mdx index 36c7b57c..53f6089b 100644 --- a/product/admin/tools-and-toolsets.mdx +++ b/product/admin/tools-and-toolsets.mdx @@ -11,7 +11,7 @@ og:description: Review discovered tools, approve and classify them, bundle them **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough. -After registering an MCP server, every tool it exposes starts life as **Unset**. This page covers reviewing those tools, approving the safe ones, classifying them, bundling them into toolsets, and binding toolsets to access profiles so end users can request them. +After adding an MCP source, every tool it exposes starts life as **Unset**. This page covers reviewing those tools, approving the safe ones, classifying them, bundling them into toolsets, and binding toolsets to access profiles so end users can request them. ## Review and govern tools @@ -19,11 +19,11 @@ Tools must be reviewed and approved before end users can request them. Use the s ### View discovered tools -Discovered tools live under each registered MCP server's own **Tools** tab. +Discovered tools live under each MCP source's own **Tools** tab. -In **AI > MCPs**, open a registered server. +In **AI > Sources**, open an MCP source. Click the **Tools** tab. @@ -92,7 +92,7 @@ Each approved tool has overrides that take precedence over the tenant defaults. ### Tool lifecycle on re-sync -C1 periodically re-runs tool discovery against each registered MCP server. When the inventory changes: +C1 periodically re-runs tool discovery against each MCP source. When the inventory changes: - **New tool detected** — added to the list as **Unset**. - **Existing tool changes** (description, parameters) — the change is recorded; the tool keeps its current state and classification. @@ -104,12 +104,12 @@ A **toolset** is a named bundle of approved tools. ### C1-maintained toolsets -C1 ships and auto-maintains two toolsets per connector: +C1 ships and auto-maintains two toolsets per MCP source: -- **All approved tools** — every tool in **Approved** state on that connector. -- **Read tools** — every **Approved** tool on that connector with Classification = Read. +- **All approved tools** — every tool in **Approved** state on that source. +- **Read tools** — every **Approved** tool on that source with Classification = Read. -Their display names are suffixed with the connector's server name — for example, `All approved tools - Slack` and `Read tools - Slack`. +Their display names are suffixed with the source name — for example, `All approved tools - Slack` and `Read tools - Slack`. Both update automatically as tools are approved or disabled. They are read-only — admins can bind them to access profiles but cannot edit their contents. diff --git a/product/admin/user-roles.mdx b/product/admin/user-roles.mdx index ec2c8820..3b8eb624 100644 --- a/product/admin/user-roles.mdx +++ b/product/admin/user-roles.mdx @@ -112,7 +112,7 @@ Users with an administrator-level user role can also access the **Admin** sectio | Access conflicts | | | | | | View | View, create, manage | | Access profiles | View, create, manage | View, manage | | | | View | View, create, manage | | Connectors | | | View, manage\* | | View, create, manage | View | View, create, manage | -| MCP servers | | View, create, manage | View, manage\* | | | View | View, create, manage | +| MCP sources | | View, create, manage | View, manage\* | | | View | View, create, manage | | Automations | | | View, create, manage\* | | | | View, create, manage | | Groups | | | | | | View | View, create, manage | | Policies | | | | | | View | View, create, manage | @@ -138,10 +138,10 @@ Users with this role can: Users with this role can: - Do everything listed in the **Basic User** role -- Register, view, and manage MCP servers across all applications +- Add, view, and manage MCP sources across all applications - Review, approve, and reject tools; create and manage toolsets - Manage AI clients -- Configure tenant-wide defaults for MCP servers, tools, and AI clients +- Configure tenant-wide defaults for MCP sources, tools, and AI clients - Edit existing access profiles to bind and unbind toolsets - Use all kill switches, including the tenant-wide emergency kill switch @@ -160,7 +160,7 @@ Users with this role can: - View and add request forms on applications that they own - Create new applications - Create and download application reports -- View and manage MCP servers and tools for applications that they own +- View and manage MCP sources and tools for applications that they own - View and manage the connectors that they own - View and manage connectors that are ownerless and associated with an application the user owns @@ -193,7 +193,7 @@ Users with this role can: - Conflict monitors - Access profiles - Connectors - - MCP servers + - MCP sources - Groups - Policies - View task log @@ -215,7 +215,7 @@ Users with this role can: - Conflict monitors - Access profiles - Connectors - - MCP servers + - MCP sources - Automations - Groups - Policies diff --git a/product/cli/c1i-commands.mdx b/product/cli/c1i-commands.mdx index afefb2da..0b3865d4 100644 --- a/product/cli/c1i-commands.mdx +++ b/product/cli/c1i-commands.mdx @@ -321,7 +321,7 @@ c1i apps list [flags] ### `create` -Create a new app — a plain, unmanaged container you can register MCP servers under. Only `--display-name` is required; app owners are managed separately via `set-owners`, not at create time. +Create a new app — a plain, unmanaged container you can add MCP sources under. Only `--display-name` is required; app owners are managed separately via `set-owners`, not at create time. **Usage:** @@ -745,7 +745,7 @@ This validates the CEL environment rules run in (`subject`, `account`, `entitlem ## MCP gateway -Call the C1 MCP gateway directly over its MCP transport — the same handshake an MCP host performs — to verify what a registered server actually exposes. This closes the configure-then-verify loop: register a server, approve its tools, then list or call them here. +Call the C1 MCP gateway directly over its MCP transport — the same handshake an MCP host performs — to verify what an MCP source exposes. This closes the configure-then-verify loop: add a source, approve its tools, then list or call them here. This covers only the `gateway` subcommand. `c1i mcp` also has `servers`, `tools`, `toolsets`, and `bindings` subcommands for managing the MCP surface itself; those aren't covered on this page yet. diff --git a/rap/mcp-gateway/INDEX.md b/rap/mcp-gateway/INDEX.md index 3e99950d..4b7bfeed 100644 --- a/rap/mcp-gateway/INDEX.md +++ b/rap/mcp-gateway/INDEX.md @@ -2,7 +2,7 @@ Documentation for interacting with ConductorOne (C1) as an MCP gateway, and for the code-mode interface agents use to call governed tools through it. Request relevant sections based on the user's question. -C1 is an MCP gateway: an AI client connects to one C1 MCP endpoint, and C1 sits in front of the organization's approved MCP servers. Agents do not connect to those upstream servers directly. Every call is identity-aware, governed per tool, and audit logged. +C1 is an MCP gateway: an AI client connects to one C1 MCP endpoint, and C1 sits in front of the organization's approved MCP sources. Agents do not connect to those upstream MCP servers directly. Every call is identity-aware, governed per tool, and audit logged. ## How to Use diff --git a/rap/mcp-gateway/concepts-gateway.md b/rap/mcp-gateway/concepts-gateway.md index c3431fe5..e1426dad 100644 --- a/rap/mcp-gateway/concepts-gateway.md +++ b/rap/mcp-gateway/concepts-gateway.md @@ -1,6 +1,6 @@ # C1 as an MCP Gateway -ConductorOne (C1) is an MCP gateway. An AI client connects to one C1 MCP endpoint, and C1 sits in front of the organization's approved MCP servers and integrations. Agents do not connect to those upstream servers directly. +ConductorOne (C1) is an MCP gateway. An AI client connects to one C1 MCP endpoint, and C1 sits in front of the organization's approved MCP sources. Agents do not connect to those upstream MCP servers directly. Mental model: **one MCP connection, many governed systems behind it.** @@ -9,23 +9,23 @@ Mental model: **one MCP connection, many governed systems behind it.** 1. **Authenticates the caller.** C1 resolves the human or workload identity behind the agent. Every tool call carries that identity — the gateway is identity-aware, not an anonymous relay. 2. **Checks governance.** The tool must be **Enabled** by an admin, and the caller must hold a **grant** for it. Both conditions are required. Enabling a tool does not grant it to anyone. 3. **Runs hooks.** Admin-configured pre-tool-use hooks may rewrite the input or deny the call. -4. **Routes upstream.** C1 forwards the call to the correct upstream server using that server's configured auth mode, so the agent never handles upstream credentials. +4. **Routes upstream.** C1 forwards the call to the correct MCP source using its configured auth mode, so the agent never handles upstream credentials. 5. **Runs post hooks.** Post-tool-use hooks may rewrite, redact, or deny the returned output. -6. **Writes an audit log entry** with identity, client, server, tool, result, denial reason, and latency. +6. **Writes an audit log entry** with identity, client, source, tool, result, denial reason, and latency. -## Upstream Server Types +## MCP source types The agent cannot tell these apart and does not need to. All appear as tools behind the same endpoint. -| Upstream | What it is | +| Source type | What it is | |----------|------------| -| Hosted catalog server | An MCP server C1 hosts and registers on the org's behalf | -| Vendor MCP server | A third-party MCP server registered by an admin | -| Bridged server | A private or on-premises MCP server reached through C1's MCP bridge | +| Catalog MCP source | A source selected from C1's available catalog | +| External MCP source | A customer- or vendor-provided upstream endpoint | +| External MCP source through a bridge | A private or on-premises endpoint reached through C1's MCP bridge | ## Toolsets, Access Profiles, and Grants -- A **tool** is one capability exposed by an upstream MCP server (for example, `github_create_issue`). +- A **tool** is one capability exposed by an MCP source (for example, `github_create_issue`). - Discovered tools start in an unreviewed state. An admin approves/enables them and may classify them by action (read / write / delete) and risk. - Approved tools are bundled into a **toolset** — either C1-maintained ("All approved", "Read-only") or an admin-curated custom toolset. - A toolset is bound to an **access profile**, which carries the approval policy, approvers, and expiry. @@ -48,7 +48,7 @@ Consequence for agents: a call can be denied by policy, or return output that ha ## Kill Switches -Admins can immediately block calls regardless of grants, at tenant, server, tool, or client level. A client kill switch revokes the client's tokens and forces re-authentication. A tool kill switch blocks that tool for everyone. These take effect mid-session. +Admins can immediately block calls regardless of grants, at tenant, source, tool, or client level. A client kill switch revokes the client's tokens and forces re-authentication. A source kill switch blocks every tool from that source. A tool kill switch blocks that tool for everyone. These take effect mid-session. ## Client Types diff --git a/rap/mcp-gateway/use-access-requests.md b/rap/mcp-gateway/use-access-requests.md index 48708439..bf8d31b6 100644 --- a/rap/mcp-gateway/use-access-requests.md +++ b/rap/mcp-gateway/use-access-requests.md @@ -1,6 +1,6 @@ # Handling Access-Request Envelopes -ConductorOne (C1) is an MCP gateway: one MCP endpoint in front of the organization's approved MCP servers, enforcing governance on every call. A tool call only executes when the tool is **Enabled** by an admin and the caller holds a **grant** for it. When the caller lacks access, the gateway does not fail opaquely — it returns a structured envelope in place of domain data. +ConductorOne (C1) is an MCP gateway: one MCP endpoint in front of the organization's approved MCP sources, enforcing governance on every call. A tool call only executes when the tool is **Enabled** by an admin and the caller holds a **grant** for it. When the caller lacks access, the gateway does not fail opaquely — it returns a structured envelope in place of domain data. This applies to any `tools.()` call inside an `execute` program, and to directly named tool calls where code mode is off. @@ -89,7 +89,7 @@ Report it as an access request awaiting approval, not as an error or an empty re ## Agent Behavior After `denied` -State the `reason` and stop. There is no access path to wait on. If the user believes the denial is wrong, the escalation path is their IT or security team — not a retry, and not another tool. Common causes: the tool is disabled or under a kill switch, the client type is not allowed for that tool, a fail-closed hook denied the call, or the caller is not an app user of the upstream server's app. +State the `reason` and stop. There is no access path to wait on. If the user believes the denial is wrong, the escalation path is their IT or security team — not a retry, and not another tool. Common causes: the tool is disabled or under a kill switch, the client type is not allowed for that tool, a fail-closed hook denied the call, or the caller is not an app user of the MCP source's app. ## Governance Working, Not Malfunctioning diff --git a/rap/mcp-gateway/use-async-executions.md b/rap/mcp-gateway/use-async-executions.md index 4644c847..0d2c0985 100644 --- a/rap/mcp-gateway/use-async-executions.md +++ b/rap/mcp-gateway/use-async-executions.md @@ -1,6 +1,6 @@ # Async Executions and Polling -ConductorOne (C1) is an MCP gateway: one MCP endpoint in front of the organization's approved MCP servers. In code mode, the agent runs work by passing a TypeScript program to `execute`. A program that runs longer than the synchronous wait window does not fail — it continues server-side and is collected by polling. +ConductorOne (C1) is an MCP gateway: one MCP endpoint in front of the organization's approved MCP sources. In code mode, the agent runs work by passing a TypeScript program to `execute`. A program that runs longer than the synchronous wait window does not fail — it continues server-side and is collected by polling. ## The Contract diff --git a/rap/mcp-gateway/use-code-mode.md b/rap/mcp-gateway/use-code-mode.md index 66b4c223..b805b705 100644 --- a/rap/mcp-gateway/use-code-mode.md +++ b/rap/mcp-gateway/use-code-mode.md @@ -1,6 +1,6 @@ # Using Code Mode -ConductorOne (C1) is an MCP gateway: one MCP endpoint in front of the organization's approved MCP servers. In **code mode**, the gateway does not list each upstream tool as its own named tool. It exposes two entrypoints, and the agent invokes upstream tools by writing a short TypeScript program. +ConductorOne (C1) is an MCP gateway: one MCP endpoint in front of the organization's approved MCP sources. In **code mode**, the gateway does not list each upstream tool as its own named tool. It exposes two entrypoints, and the agent invokes upstream tools by writing a short TypeScript program. | Entrypoint | Purpose | |------------|---------| diff --git a/scripts/nav-paths.json b/scripts/nav-paths.json index 61b42df2..1cf019c0 100644 --- a/scripts/nav-paths.json +++ b/scripts/nav-paths.json @@ -212,10 +212,10 @@ ] }, { - "path": "Integrations > MCP servers", + "path": "Integrations > Sources", "segments": [ "Integrations", - "MCP servers" + "Sources" ] }, { From 3d2c222cb6051fd0dd4e0490c53fb858f7029e34 Mon Sep 17 00:00:00 2001 From: Paul Querna Date: Fri, 11 Sep 2026 21:41:49 +0000 Subject: [PATCH 2/3] Clarify MCP source terminology Co-authored-by: c1-squire-dev[bot] --- product/admin/audit-ai-tool-usage.mdx | 2 +- product/admin/enable-ai-access-management.mdx | 4 ++-- product/admin/mcp-resources.mdx | 2 +- product/admin/mcp-server/apollo.mdx | 2 +- product/admin/mcp-server/auth0.mdx | 2 +- product/admin/mcp-server/azure-devops.mdx | 2 +- product/admin/mcp-server/bitbucket.mdx | 2 +- product/admin/mcp-server/box.mdx | 2 +- product/admin/mcp-server/buildkite.mdx | 2 +- product/admin/mcp-server/confluence.mdx | 2 +- product/admin/mcp-server/crowdstrike.mdx | 2 +- product/admin/mcp-server/datadog.mdx | 2 +- product/admin/mcp-server/freshdesk.mdx | 2 +- product/admin/mcp-server/github.mdx | 4 ++-- product/admin/mcp-server/gong.mdx | 2 +- product/admin/mcp-server/google-analytics-admin.mdx | 2 +- product/admin/mcp-server/google-analytics.mdx | 2 +- .../admin/mcp-server/google-cloud-project-setup.mdx | 10 +++++----- product/admin/mcp-server/google-drive.mdx | 4 ++-- product/admin/mcp-server/granola.mdx | 4 ++-- product/admin/mcp-server/hubspot.mdx | 2 +- product/admin/mcp-server/jira-service-management.mdx | 2 +- product/admin/mcp-server/jira.mdx | 2 +- product/admin/mcp-server/linear.mdx | 4 ++-- product/admin/mcp-server/linkedin.mdx | 2 +- product/admin/mcp-server/looker.mdx | 2 +- product/admin/mcp-server/lucid.mdx | 4 ++-- product/admin/mcp-server/mcp-bridge.mdx | 6 +++--- product/admin/mcp-server/metabase.mdx | 2 +- product/admin/mcp-server/metronome.mdx | 2 +- product/admin/mcp-server/monday.mdx | 4 ++-- product/admin/mcp-server/n8n.mdx | 4 ++-- product/admin/mcp-server/notion.mdx | 4 ++-- product/admin/mcp-server/okta.mdx | 2 +- product/admin/mcp-server/opsgenie.mdx | 2 +- product/admin/mcp-server/pagerduty.mdx | 4 ++-- product/admin/mcp-server/pylon.mdx | 4 ++-- product/admin/mcp-server/ramp.mdx | 2 +- product/admin/mcp-server/rapid7.mdx | 2 +- product/admin/mcp-server/salesforce.mdx | 2 +- product/admin/mcp-server/slack.mdx | 4 ++-- product/admin/mcp-server/snowflake.mdx | 2 +- product/admin/mcp-server/statuspage.mdx | 2 +- product/admin/mcp-server/tableau.mdx | 2 +- product/admin/mcp-server/trello.mdx | 2 +- product/admin/mcp-server/vectara.mdx | 2 +- product/admin/mcp-server/wiz.mdx | 2 +- product/admin/mcp-servers.mdx | 4 ++-- product/admin/tools-and-toolsets.mdx | 2 +- rap/mcp-gateway/concepts-gateway.md | 6 +++--- scripts/nav-paths.json | 4 ++-- 51 files changed, 73 insertions(+), 73 deletions(-) diff --git a/product/admin/audit-ai-tool-usage.mdx b/product/admin/audit-ai-tool-usage.mdx index ca049c53..761d0a97 100644 --- a/product/admin/audit-ai-tool-usage.mdx +++ b/product/admin/audit-ai-tool-usage.mdx @@ -22,7 +22,7 @@ Each tool call produces one audit log entry with: | **Timestamp** | `2026-05-07T14:23:11Z` | | **End user** | The C1 user the AI client is bound to | | **AI client** | Client ID and display name | -| **MCP source** | Source name | +| **MCP source** | MCP source name | | **Tool** | Tool name (for example, `github_create_issue`) | | **Result** | Success / denied / error | | **Denial reason** | Populated when result = denied (for example, "tool not in user's access profile", "kill switch active", "client closed") | diff --git a/product/admin/enable-ai-access-management.mdx b/product/admin/enable-ai-access-management.mdx index 81bd1feb..7b1af632 100644 --- a/product/admin/enable-ai-access-management.mdx +++ b/product/admin/enable-ai-access-management.mdx @@ -37,7 +37,7 @@ Click **Save** to confirm. -Once enabled, **Sources**, **MCP clients**, and the **AIAM audit log** appear in the tenant. +Once enabled, **MCP Sources**, **MCP clients**, and the **AIAM audit log** appear in the tenant. ## Configure tenant defaults @@ -85,7 +85,7 @@ To change the defaults: -In **AI > Sources > Settings**, find **Default tool classification**. +In **AI > MCP Sources > Settings**, find **Default tool classification**. Select the state and classification to apply to newly-discovered tools. diff --git a/product/admin/mcp-resources.mdx b/product/admin/mcp-resources.mdx index f1a44ecb..d9583a2e 100644 --- a/product/admin/mcp-resources.mdx +++ b/product/admin/mcp-resources.mdx @@ -34,7 +34,7 @@ To see the resources C1 discovered from an MCP source, open the source's resourc -Go to **AI > Sources**. +Go to **AI > MCP Sources**. Open an MCP source. diff --git a/product/admin/mcp-server/apollo.mdx b/product/admin/mcp-server/apollo.mdx index 7b919bc8..0b6adbe6 100644 --- a/product/admin/mcp-server/apollo.mdx +++ b/product/admin/mcp-server/apollo.mdx @@ -73,7 +73,7 @@ Save your changes. C1 starts a sync that discovers the tools the Apollo server e After you add the source, C1 runs tool discovery against Apollo. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Apollo tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/auth0.mdx b/product/admin/mcp-server/auth0.mdx index ef8b15ba..50cb0e20 100644 --- a/product/admin/mcp-server/auth0.mdx +++ b/product/admin/mcp-server/auth0.mdx @@ -78,7 +78,7 @@ Save your changes. C1 starts a sync that discovers the tools the Auth0 server ex After you add the source, C1 runs tool discovery against Auth0. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Auth0 tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/azure-devops.mdx b/product/admin/mcp-server/azure-devops.mdx index 352aabcd..376686c8 100644 --- a/product/admin/mcp-server/azure-devops.mdx +++ b/product/admin/mcp-server/azure-devops.mdx @@ -134,7 +134,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Azure DevOps. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Azure DevOps tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/bitbucket.mdx b/product/admin/mcp-server/bitbucket.mdx index 9ea600db..4df40379 100644 --- a/product/admin/mcp-server/bitbucket.mdx +++ b/product/admin/mcp-server/bitbucket.mdx @@ -166,7 +166,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Bitbucket. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Bitbucket tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/box.mdx b/product/admin/mcp-server/box.mdx index c9ff09af..430e74e9 100644 --- a/product/admin/mcp-server/box.mdx +++ b/product/admin/mcp-server/box.mdx @@ -100,7 +100,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Box. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Box tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/buildkite.mdx b/product/admin/mcp-server/buildkite.mdx index cf6a16de..865d8dd2 100644 --- a/product/admin/mcp-server/buildkite.mdx +++ b/product/admin/mcp-server/buildkite.mdx @@ -81,7 +81,7 @@ Save your changes. C1 starts a sync that discovers the tools the Buildkite serve After you add the source, C1 runs tool discovery against Buildkite. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Buildkite tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/confluence.mdx b/product/admin/mcp-server/confluence.mdx index 5120ff72..0a39c900 100644 --- a/product/admin/mcp-server/confluence.mdx +++ b/product/admin/mcp-server/confluence.mdx @@ -103,7 +103,7 @@ Save your changes. The first time a user calls a Confluence tool from their AI c After you add the source, C1 runs tool discovery against Confluence. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Confluence tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/crowdstrike.mdx b/product/admin/mcp-server/crowdstrike.mdx index c5180daf..ac9a1b1a 100644 --- a/product/admin/mcp-server/crowdstrike.mdx +++ b/product/admin/mcp-server/crowdstrike.mdx @@ -85,7 +85,7 @@ Save your changes. C1 starts a sync that discovers the tools the CrowdStrike ser After you add the source, C1 runs tool discovery against CrowdStrike. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a CrowdStrike tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/datadog.mdx b/product/admin/mcp-server/datadog.mdx index d26faf80..c43ca752 100644 --- a/product/admin/mcp-server/datadog.mdx +++ b/product/admin/mcp-server/datadog.mdx @@ -126,7 +126,7 @@ Save your changes. C1 starts a sync that discovers the tools the Datadog server After you add the source, C1 runs tool discovery against Datadog. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification) for details. +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification) for details. Before anyone can call a Datadog tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to complete this setup. diff --git a/product/admin/mcp-server/freshdesk.mdx b/product/admin/mcp-server/freshdesk.mdx index 6c1cbb44..d7b77f80 100644 --- a/product/admin/mcp-server/freshdesk.mdx +++ b/product/admin/mcp-server/freshdesk.mdx @@ -72,7 +72,7 @@ Save your changes. C1 starts a sync that discovers the tools the Freshdesk serve After you add the source, C1 runs tool discovery against Freshdesk. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Freshdesk tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/github.mdx b/product/admin/mcp-server/github.mdx index 731376db..e27a2c2b 100644 --- a/product/admin/mcp-server/github.mdx +++ b/product/admin/mcp-server/github.mdx @@ -123,7 +123,7 @@ When you [configure authentication](/product/admin/mcp-servers#configure-authent After you add the source, C1 runs tool discovery against GitHub's hosted MCP server. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a GitHub tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -258,7 +258,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against GitHub. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a GitHub tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/gong.mdx b/product/admin/mcp-server/gong.mdx index b4b53373..b06ace60 100644 --- a/product/admin/mcp-server/gong.mdx +++ b/product/admin/mcp-server/gong.mdx @@ -84,7 +84,7 @@ Save your changes. C1 starts a sync that discovers the tools the Gong server exp After you add the source, C1 runs tool discovery against Gong. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Gong tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/google-analytics-admin.mdx b/product/admin/mcp-server/google-analytics-admin.mdx index 68c6d119..75ffd7f1 100644 --- a/product/admin/mcp-server/google-analytics-admin.mdx +++ b/product/admin/mcp-server/google-analytics-admin.mdx @@ -137,7 +137,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Google Analytics Admin. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Google Analytics Admin tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/google-analytics.mdx b/product/admin/mcp-server/google-analytics.mdx index 517ae943..9abacd92 100644 --- a/product/admin/mcp-server/google-analytics.mdx +++ b/product/admin/mcp-server/google-analytics.mdx @@ -133,7 +133,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Google Analytics. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Google Analytics tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/google-cloud-project-setup.mdx b/product/admin/mcp-server/google-cloud-project-setup.mdx index 9c417ef2..d4a7218c 100644 --- a/product/admin/mcp-server/google-cloud-project-setup.mdx +++ b/product/admin/mcp-server/google-cloud-project-setup.mdx @@ -44,11 +44,11 @@ Create a new project for C1, or select an existing one. Note its **Project ID** -## Enable the APIs for your sources +## Enable the APIs for your MCP sources -Enable one API per Google source you plan to use. In the console, go to **APIs & Services** > **Library**, search for the API by name, and select **Enable**. The service ID is the identifier you use with the `gcloud` CLI. +Enable one API per Google MCP source you plan to use. In the console, go to **APIs & Services** > **Library**, search for the API by name, and select **Enable**. The service ID is the identifier you use with the `gcloud` CLI. -| Source | API to enable | Service ID | +| MCP source | API to enable | Service ID | | :--- | :--- | :--- | | Google Drive | Google Drive API | `drive.googleapis.com` | | Google Docs | Google Docs API | `docs.googleapis.com` | @@ -408,7 +408,7 @@ Then follow the source-specific page for anything unique to that source: - [Google Analytics Admin](/product/admin/mcp-server/google-analytics-admin) -Sources without a dedicated page above use the same [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) flow. If a Google source you want isn't in your catalog yet, [contact the C1 support team](mailto:support@c1.ai). +MCP sources without a dedicated page above use the same [Add an MCP source](/product/admin/mcp-servers#add-an-mcp-source) flow. If a Google source you want isn't in your catalog yet, [contact the C1 support team](mailto:support@c1.ai). ## Troubleshoot Google Cloud project errors @@ -416,7 +416,7 @@ Sources without a dedicated page above use the same [Add an MCP source](/product | Symptom | Cause | Fix | | :--- | :--- | :--- | | `PERMISSION_DENIED: Caller does not have required permission to use project ...` | The caller lacks `serviceusage.services.use` on the quota project. | Grant the **Service Usage Consumer** role — see [Grant users permission to use the project](#grant-users-permission-to-use-the-project). | -| `SERVICE_DISABLED` / "API has not been used in project ... before or it is disabled" | The source's API isn't enabled in the quota project. | Enable it — see [Enable the APIs for your sources](#enable-the-apis-for-your-sources). | +| `SERVICE_DISABLED` / "API has not been used in project ... before or it is disabled" | The MCP source's API isn't enabled in the quota project. | Enable it — see [Enable the APIs for your MCP sources](#enable-the-apis-for-your-mcp-sources). | | Authorization flow fails after the user consents | The redirect URI doesn't match. | Set it to exactly `https://accounts.conductor.one/auth/callback` — see [Create the client credentials](#create-the-client-credentials). | | A restricted-scope warning blocks External users | The app needs Google verification for restricted scopes. | Use an **Internal** consent screen for Workspace-only use, or complete Google's verification for External use. | | "Google hasn't verified this app" blocks sign-in | The External app isn't verified and the user isn't a test user. | Add the user as a **test user** on the consent screen, or complete Google's verification. | diff --git a/product/admin/mcp-server/google-drive.mdx b/product/admin/mcp-server/google-drive.mdx index 032ec370..5e33e0d4 100644 --- a/product/admin/mcp-server/google-drive.mdx +++ b/product/admin/mcp-server/google-drive.mdx @@ -91,7 +91,7 @@ This option only supports per-user OAuth — there's no shared, service-account, After you add the source, C1 runs tool discovery against Google's Drive MCP server. Discovered tools appear on the source's **Tools** tab and include Google's own search, file content, metadata, permissions, and file creation and copying tools. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Google Drive tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -227,7 +227,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Google Drive. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Google Drive tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/granola.mdx b/product/admin/mcp-server/granola.mdx index cac1c6c7..f851b904 100644 --- a/product/admin/mcp-server/granola.mdx +++ b/product/admin/mcp-server/granola.mdx @@ -70,7 +70,7 @@ This option only supports per-user OAuth — there's no shared, service-account, After you add the source, C1 runs tool discovery against Granola's MCP server. Discovered tools appear on the source's **Tools** tab and include Granola's meeting-notes search, folder browsing, meeting listing, and note-reading tools. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Granola tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -141,7 +141,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Granola. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Granola tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/hubspot.mdx b/product/admin/mcp-server/hubspot.mdx index dc1b0674..1802ea32 100644 --- a/product/admin/mcp-server/hubspot.mdx +++ b/product/admin/mcp-server/hubspot.mdx @@ -76,7 +76,7 @@ Save your changes. C1 starts a sync that discovers the tools the HubSpot server After you add the source, C1 runs tool discovery against HubSpot. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a HubSpot tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/jira-service-management.mdx b/product/admin/mcp-server/jira-service-management.mdx index eb159bfe..55fba720 100644 --- a/product/admin/mcp-server/jira-service-management.mdx +++ b/product/admin/mcp-server/jira-service-management.mdx @@ -85,7 +85,7 @@ Save your changes. The first time a user calls a Jira Service Management tool fr After you add the source, C1 runs tool discovery against Jira Service Management. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Jira Service Management tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/jira.mdx b/product/admin/mcp-server/jira.mdx index 4d1d9114..057ae5ea 100644 --- a/product/admin/mcp-server/jira.mdx +++ b/product/admin/mcp-server/jira.mdx @@ -106,7 +106,7 @@ Save your changes. The first time a user calls a Jira tool from their AI client, After you add the source, C1 runs tool discovery against Jira. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Jira tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/linear.mdx b/product/admin/mcp-server/linear.mdx index 99dc7195..7a0bf04a 100644 --- a/product/admin/mcp-server/linear.mdx +++ b/product/admin/mcp-server/linear.mdx @@ -118,7 +118,7 @@ With per-user OAuth, tool calls run with the connected user's own Linear permiss After you add the source, C1 runs tool discovery against Linear's MCP server. Discovered tools appear on the source's **Tools** tab and include Linear's own tools for finding, creating, and updating issues, projects, and comments. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Linear tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -257,7 +257,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Linear. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Linear tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/linkedin.mdx b/product/admin/mcp-server/linkedin.mdx index f2528e3d..64a5def9 100644 --- a/product/admin/mcp-server/linkedin.mdx +++ b/product/admin/mcp-server/linkedin.mdx @@ -79,7 +79,7 @@ Save your changes. The first time a user calls a LinkedIn tool from their AI cli After you add the source, C1 runs tool discovery against LinkedIn. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a LinkedIn tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/looker.mdx b/product/admin/mcp-server/looker.mdx index 04e64778..c85aca36 100644 --- a/product/admin/mcp-server/looker.mdx +++ b/product/admin/mcp-server/looker.mdx @@ -78,7 +78,7 @@ Save your changes. C1 starts a sync that discovers the tools the Looker server e After you add the source, C1 runs tool discovery against Looker. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Looker tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/lucid.mdx b/product/admin/mcp-server/lucid.mdx index f2c6d29d..bb3f976c 100644 --- a/product/admin/mcp-server/lucid.mdx +++ b/product/admin/mcp-server/lucid.mdx @@ -74,7 +74,7 @@ This option only supports per-user OAuth — there's no shared, service-account, After you add the source, C1 runs tool discovery against Lucid's MCP server. Discovered tools appear on the source's **Tools** tab and include Lucid's own document search and fetch tools, diagram creation (including org charts, mind maps, and UML sequence diagrams), image export, and sharing. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Lucid tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -208,7 +208,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Lucid. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Lucid tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/mcp-bridge.mdx b/product/admin/mcp-server/mcp-bridge.mdx index 3ccdf36c..49ee3469 100644 --- a/product/admin/mcp-server/mcp-bridge.mdx +++ b/product/admin/mcp-server/mcp-bridge.mdx @@ -249,9 +249,9 @@ With the bridge running, add an External MCP source in C1 so its tools are avail -Open the app you want the MCP source linked to, go to its **Sources** tab, and click **Add MCP source**. +Open the app you want the MCP source linked to, go to its **MCP Sources** tab, and click **Add MCP source**. -If you're starting from the tenant-wide Sources page (**AI** > **Sources**) instead, the wizard adds a **Choose app** step so you can pick or create the destination app. +If you're starting from the tenant-wide MCP Sources page (**AI** > **MCP Sources**) instead, the wizard adds a **Choose app** step so you can pick or create the destination app. Under **Choose a source**, select **External MCP source** — "Connect to an external MCP server by URL." @@ -272,7 +272,7 @@ In the **Authentication** section, pick the **Authentication method** C1 uses to C1 connects to your server over the bridge and begins tool discovery. -A user can only call a tool once they're an **app user** of the app the source is linked to. New external apps start with no app users. When you add a source from an existing app that has none, the wizard inserts a **Link users** step to populate them by linking an entitlement from another app. When you start from the tenant-wide Sources page instead, you get the **Choose app** step (not **Link users**) — populate app users afterward from the app's settings. See [Calling the tools from an AI client](#calling-the-tools-from-an-ai-client) for the full set of ways to do this. +A user can only call a tool once they're an **app user** of the app the source is linked to. New external apps start with no app users. When you add a source from an existing app that has none, the wizard inserts a **Link users** step to populate them by linking an entitlement from another app. When you start from the tenant-wide MCP Sources page instead, you get the **Choose app** step (not **Link users**) — populate app users afterward from the app's settings. See [Calling the tools from an AI client](#calling-the-tools-from-an-ai-client) for the full set of ways to do this. ## Step 5: Review discovered tools diff --git a/product/admin/mcp-server/metabase.mdx b/product/admin/mcp-server/metabase.mdx index c65b10cc..5740be95 100644 --- a/product/admin/mcp-server/metabase.mdx +++ b/product/admin/mcp-server/metabase.mdx @@ -78,7 +78,7 @@ Save your changes. C1 starts a sync that discovers the tools the Metabase server After you add the source, C1 runs tool discovery against Metabase. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Metabase tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/metronome.mdx b/product/admin/mcp-server/metronome.mdx index 5430782f..9590f44d 100644 --- a/product/admin/mcp-server/metronome.mdx +++ b/product/admin/mcp-server/metronome.mdx @@ -78,7 +78,7 @@ Save your changes. C1 starts a sync that discovers the tools the Metronome serve After you add the source, C1 runs tool discovery against Metronome. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Metronome tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/monday.mdx b/product/admin/mcp-server/monday.mdx index 42b657e5..67e0ba3e 100644 --- a/product/admin/mcp-server/monday.mdx +++ b/product/admin/mcp-server/monday.mdx @@ -73,7 +73,7 @@ This option only supports per-user OAuth — there's no shared, service-account, After you add the source, C1 runs tool discovery against monday.com's MCP server. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Monday tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -146,7 +146,7 @@ Save your changes. C1 starts a sync that discovers the tools the monday.com serv After you add the source, C1 runs tool discovery against monday.com. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a monday.com tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/n8n.mdx b/product/admin/mcp-server/n8n.mdx index 7f35fc58..24159021 100644 --- a/product/admin/mcp-server/n8n.mdx +++ b/product/admin/mcp-server/n8n.mdx @@ -116,7 +116,7 @@ Access depends on the authentication method you chose: After you add the source, C1 runs tool discovery against n8n's MCP server. Discovered tools appear on the source's **Tools** tab and include n8n's own workflow search, execution, testing, and publishing tools; execution history lookups; credential listing; workflow building and validation; and data table management. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an n8n tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -200,7 +200,7 @@ Save your changes. C1 starts a sync that discovers the tools the n8n server expo After you add the source, C1 runs tool discovery against n8n. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an n8n tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/notion.mdx b/product/admin/mcp-server/notion.mdx index 0379e51a..cc2d6c8b 100644 --- a/product/admin/mcp-server/notion.mdx +++ b/product/admin/mcp-server/notion.mdx @@ -71,7 +71,7 @@ This option only supports per-user OAuth — there's no shared, service-account, After you add the source, C1 runs tool discovery against Notion's MCP server. Discovered tools appear on the source's **Tools** tab and include Notion's own search and fetch tools, page and database creation and editing, page duplication, comments, teamspaces, users, and database views. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Notion tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -204,7 +204,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Notion. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Notion tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/okta.mdx b/product/admin/mcp-server/okta.mdx index 83a4d134..812467cb 100644 --- a/product/admin/mcp-server/okta.mdx +++ b/product/admin/mcp-server/okta.mdx @@ -137,7 +137,7 @@ Save your changes. With per-user OAuth, the first time a user calls an Okta tool After you add the source, C1 runs tool discovery against Okta. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Okta tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/opsgenie.mdx b/product/admin/mcp-server/opsgenie.mdx index 6af2fae6..278a3c42 100644 --- a/product/admin/mcp-server/opsgenie.mdx +++ b/product/admin/mcp-server/opsgenie.mdx @@ -75,7 +75,7 @@ Save your changes. C1 starts a sync that discovers the tools the Opsgenie server After you add the source, C1 runs tool discovery against Opsgenie. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call an Opsgenie tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/pagerduty.mdx b/product/admin/mcp-server/pagerduty.mdx index 6c4b0737..616b30ac 100644 --- a/product/admin/mcp-server/pagerduty.mdx +++ b/product/admin/mcp-server/pagerduty.mdx @@ -148,7 +148,7 @@ How PagerDuty sees your users' activity depends on the method you chose: After you add the source, C1 runs tool discovery against PagerDuty's hosted MCP server. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a PagerDuty tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -286,7 +286,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against PagerDuty. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a PagerDuty tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/pylon.mdx b/product/admin/mcp-server/pylon.mdx index 60372f5e..e3fc52c8 100644 --- a/product/admin/mcp-server/pylon.mdx +++ b/product/admin/mcp-server/pylon.mdx @@ -71,7 +71,7 @@ This option only supports per-user OAuth — there's no shared, service-account, After you add the source, C1 runs tool discovery against Pylon's MCP server. Discovered tools appear on the source's **Tools** tab and include Pylon's own search, read, create, and update tools for issues, accounts, and contacts. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Pylon tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -145,7 +145,7 @@ Every user's tool calls use the one bearer token you provided, so Pylon sees a s After you add the source, C1 runs tool discovery against Pylon. Discovered tools appear on the source's **Tools** tab and include issues, accounts, contacts, teams, users, knowledge bases, and tags. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Pylon tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/ramp.mdx b/product/admin/mcp-server/ramp.mdx index 64d9bb96..110b212f 100644 --- a/product/admin/mcp-server/ramp.mdx +++ b/product/admin/mcp-server/ramp.mdx @@ -100,7 +100,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Ramp. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Ramp tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/rapid7.mdx b/product/admin/mcp-server/rapid7.mdx index 21fee182..1b773624 100644 --- a/product/admin/mcp-server/rapid7.mdx +++ b/product/admin/mcp-server/rapid7.mdx @@ -79,7 +79,7 @@ Save your changes. C1 starts a sync that discovers the tools the Rapid7 server e After you add the source, C1 runs tool discovery against Rapid7. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Rapid7 tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/salesforce.mdx b/product/admin/mcp-server/salesforce.mdx index 3588301a..9e5d7300 100644 --- a/product/admin/mcp-server/salesforce.mdx +++ b/product/admin/mcp-server/salesforce.mdx @@ -99,7 +99,7 @@ Save your changes. The first time a user calls a Salesforce tool from their AI c After you add the source, C1 runs tool discovery against Salesforce. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Salesforce tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/slack.mdx b/product/admin/mcp-server/slack.mdx index c1a93f14..aae3d4f6 100644 --- a/product/admin/mcp-server/slack.mdx +++ b/product/admin/mcp-server/slack.mdx @@ -202,7 +202,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Slack's MCP server. Discovered tools appear on the source's **Tools** tab and are exactly the ones Slack's own MCP server exposes. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Slack tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. @@ -353,7 +353,7 @@ Save your changes. The first time a user calls a Slack tool from their AI client After you add the source, C1 runs tool discovery against Slack. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Slack tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/snowflake.mdx b/product/admin/mcp-server/snowflake.mdx index 47d2c6b7..f17a1351 100644 --- a/product/admin/mcp-server/snowflake.mdx +++ b/product/admin/mcp-server/snowflake.mdx @@ -244,7 +244,7 @@ Every user's tool calls use the one token you provided, so Snowflake sees a sing After you add the source, C1 runs tool discovery against Snowflake. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Snowflake tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/statuspage.mdx b/product/admin/mcp-server/statuspage.mdx index 9336f693..3cca36e0 100644 --- a/product/admin/mcp-server/statuspage.mdx +++ b/product/admin/mcp-server/statuspage.mdx @@ -75,7 +75,7 @@ Save your changes. C1 starts a sync that discovers the tools the Statuspage serv After you add the source, C1 runs tool discovery against Statuspage. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Statuspage tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/tableau.mdx b/product/admin/mcp-server/tableau.mdx index 2df6affb..32f1c7ff 100644 --- a/product/admin/mcp-server/tableau.mdx +++ b/product/admin/mcp-server/tableau.mdx @@ -110,7 +110,7 @@ Save your changes. C1 starts a sync that discovers the tools the Tableau server After you add the source, C1 runs tool discovery against Tableau. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Tableau tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/trello.mdx b/product/admin/mcp-server/trello.mdx index a5779352..20d3e534 100644 --- a/product/admin/mcp-server/trello.mdx +++ b/product/admin/mcp-server/trello.mdx @@ -75,7 +75,7 @@ Save your changes. C1 starts a sync that discovers the tools the Trello server e After you add the source, C1 runs tool discovery against Trello. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Trello tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/vectara.mdx b/product/admin/mcp-server/vectara.mdx index 22d7fd3a..eb4398fd 100644 --- a/product/admin/mcp-server/vectara.mdx +++ b/product/admin/mcp-server/vectara.mdx @@ -127,7 +127,7 @@ For how shared and per-user credentials work across MCP sources, see [Configure After you add the source, C1 runs tool discovery against Vectara. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Vectara tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-server/wiz.mdx b/product/admin/mcp-server/wiz.mdx index b475d7b3..c054b4d2 100644 --- a/product/admin/mcp-server/wiz.mdx +++ b/product/admin/mcp-server/wiz.mdx @@ -80,7 +80,7 @@ Save your changes. C1 starts a sync that discovers the tools the Wiz server expo After you add the source, C1 runs tool discovery against Wiz. Discovered tools appear on the source's **Tools** tab. -Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). +Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the source was set up or your tenant's default tool settings in **AI** > **MCP Sources** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification). Before anyone can call a Wiz tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up. diff --git a/product/admin/mcp-servers.mdx b/product/admin/mcp-servers.mdx index 2b5cbff0..9b0c882b 100644 --- a/product/admin/mcp-servers.mdx +++ b/product/admin/mcp-servers.mdx @@ -25,7 +25,7 @@ C1 walks you through adding an MCP source one question at a time, whether you ch -In C1, go to **AI > Sources** and click **Add MCP source**. +In C1, go to **AI > MCP Sources** and click **Add MCP source**. Choose a Catalog MCP source from the shortlist or browse all available sources, or add an External MCP source using a custom URL. @@ -45,7 +45,7 @@ Review and submit. C1 adds the source and runs initial discovery. **Access profile selection isn't applied yet.** The guided flow lets you choose an access profile during setup, but that selection currently isn't bound to the source — it's recorded but not enforced. Assign an access profile afterward from the source's settings, or through [Govern tools and toolsets](/product/admin/tools-and-toolsets), rather than relying on the in-flow selection. -After setup, the source appears in **AI > Sources**. Its discovered tools are listed on the **Tools** tab. If the source exposes resources, they are listed on the **Resources** tab. You can sort the **Tools** tab by tool name, visibility, classification, state, and last updated. +After setup, the source appears in **AI > MCP Sources**. Its discovered tools are listed on the **Tools** tab. If the source exposes resources, they are listed on the **Resources** tab. You can sort the **Tools** tab by tool name, visibility, classification, state, and last updated. The source's URL can't be changed once it completes its first successful sync. To point at a different endpoint, add a new MCP source instead. diff --git a/product/admin/tools-and-toolsets.mdx b/product/admin/tools-and-toolsets.mdx index 53f6089b..4b80ceeb 100644 --- a/product/admin/tools-and-toolsets.mdx +++ b/product/admin/tools-and-toolsets.mdx @@ -23,7 +23,7 @@ Discovered tools live under each MCP source's own **Tools** tab. -In **AI > Sources**, open an MCP source. +In **AI > MCP Sources**, open an MCP source. Click the **Tools** tab. diff --git a/rap/mcp-gateway/concepts-gateway.md b/rap/mcp-gateway/concepts-gateway.md index e1426dad..f532263e 100644 --- a/rap/mcp-gateway/concepts-gateway.md +++ b/rap/mcp-gateway/concepts-gateway.md @@ -11,15 +11,15 @@ Mental model: **one MCP connection, many governed systems behind it.** 3. **Runs hooks.** Admin-configured pre-tool-use hooks may rewrite the input or deny the call. 4. **Routes upstream.** C1 forwards the call to the correct MCP source using its configured auth mode, so the agent never handles upstream credentials. 5. **Runs post hooks.** Post-tool-use hooks may rewrite, redact, or deny the returned output. -6. **Writes an audit log entry** with identity, client, source, tool, result, denial reason, and latency. +6. **Writes an audit log entry** with identity, client, MCP source, tool, result, denial reason, and latency. ## MCP source types The agent cannot tell these apart and does not need to. All appear as tools behind the same endpoint. -| Source type | What it is | +| MCP source type | What it is | |----------|------------| -| Catalog MCP source | A source selected from C1's available catalog | +| Catalog MCP source | An MCP source selected from C1's available catalog | | External MCP source | A customer- or vendor-provided upstream endpoint | | External MCP source through a bridge | A private or on-premises endpoint reached through C1's MCP bridge | diff --git a/scripts/nav-paths.json b/scripts/nav-paths.json index 1cf019c0..93c01556 100644 --- a/scripts/nav-paths.json +++ b/scripts/nav-paths.json @@ -212,10 +212,10 @@ ] }, { - "path": "Integrations > Sources", + "path": "Integrations > MCP sources", "segments": [ "Integrations", - "Sources" + "MCP sources" ] }, { From 4e2376e4a1dfe0caf6b03503ea69614ceeae1800 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Fri, 11 Sep 2026 15:56:31 -0700 Subject: [PATCH 3/3] docs: apply style guide fixes Co-Authored-By: Claude Sonnet 5 --- product/admin/audit-ai-tool-usage.mdx | 2 +- product/admin/enable-ai-access-management.mdx | 2 +- product/admin/mcp-server/okta.mdx | 2 +- product/admin/user-roles.mdx | 2 +- rap/mcp-gateway/concepts-gateway.md | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/product/admin/audit-ai-tool-usage.mdx b/product/admin/audit-ai-tool-usage.mdx index 761d0a97..187eb025 100644 --- a/product/admin/audit-ai-tool-usage.mdx +++ b/product/admin/audit-ai-tool-usage.mdx @@ -36,7 +36,7 @@ In addition to tool call events, the following non-call events are also captured - Tool approved / disabled / classification changed - MCP source added / removed / auth changed - AI client registered / state changed (active → hidden → closed → deleted) -- Kill switch flipped (tenant, server, tool, or client level) +- Kill switch flipped (tenant, source, tool, or client level) - Tenant defaults changed ## Review AI agent conversations diff --git a/product/admin/enable-ai-access-management.mdx b/product/admin/enable-ai-access-management.mdx index 7b1af632..37c1a121 100644 --- a/product/admin/enable-ai-access-management.mdx +++ b/product/admin/enable-ai-access-management.mdx @@ -37,7 +37,7 @@ Click **Save** to confirm. -Once enabled, **MCP Sources**, **MCP clients**, and the **AIAM audit log** appear in the tenant. +Once enabled, **MCP sources**, **MCP clients**, and the **AIAM audit log** appear in the tenant. ## Configure tenant defaults diff --git a/product/admin/mcp-server/okta.mdx b/product/admin/mcp-server/okta.mdx index 812467cb..9ee9eb62 100644 --- a/product/admin/mcp-server/okta.mdx +++ b/product/admin/mcp-server/okta.mdx @@ -99,7 +99,7 @@ C1 requests these read scopes by default. Together they let the server read the These are Okta **administrator** scopes. Okta limits each token to what the authorizing account's admin role permits, so grant read scopes to an account with a read-capable admin role — for example, a read-only administrator. A token can hold a scope but still return nothing if the account lacks the matching admin permission. -To enable tools that **modify** Okta, grant the matching management scope — for example `okta.users.manage` for user writes or `okta.groups.manage` for group writes — on the app's **Okta API Scopes** tab, then add it to the server's scopes in C1. Grant management scopes only where you need write access, and only to an account whose admin role allows those changes. +To enable tools that **modify** Okta, grant the matching management scope — for example `okta.users.manage` for user writes or `okta.groups.manage` for group writes — on the app's **Okta API Scopes** tab, then add it to the source's scopes in C1. Grant management scopes only where you need write access, and only to an account whose admin role allows those changes. Scope changes take effect the next time a user authorizes. If you add scopes after someone has already connected, they keep their existing grants until they reconnect their Okta account, and tools that need the new scopes return an authorization error until they do. diff --git a/product/admin/user-roles.mdx b/product/admin/user-roles.mdx index 3b8eb624..e5cf13c4 100644 --- a/product/admin/user-roles.mdx +++ b/product/admin/user-roles.mdx @@ -147,7 +147,7 @@ Users with this role can: Users with this role **cannot** assign or revoke user roles, create or delete access profiles, or access non-AIAM admin settings. -Application Administrators who own an application can review tools and configure per-MCP and per-tool settings for their own apps. The AI Governance Administrator role spans all applications. +Application Administrators who own an application can review tools and configure per-source and per-tool settings for their own apps. The AI Governance Administrator role spans all applications. ### Application Administrator diff --git a/rap/mcp-gateway/concepts-gateway.md b/rap/mcp-gateway/concepts-gateway.md index f532263e..2f81278a 100644 --- a/rap/mcp-gateway/concepts-gateway.md +++ b/rap/mcp-gateway/concepts-gateway.md @@ -48,7 +48,7 @@ Consequence for agents: a call can be denied by policy, or return output that ha ## Kill Switches -Admins can immediately block calls regardless of grants, at tenant, source, tool, or client level. A client kill switch revokes the client's tokens and forces re-authentication. A source kill switch blocks every tool from that source. A tool kill switch blocks that tool for everyone. These take effect mid-session. +Admins can immediately block calls regardless of grants, at tenant, MCP source, tool, or client level. A client kill switch revokes the client's tokens and forces re-authentication. An MCP source kill switch blocks every tool from that MCP source. A tool kill switch blocks that tool for everyone. These take effect mid-session. ## Client Types