Skip to content

docs(TSP-1356): document MCP run-only access and Viewer role MCP support #733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
claude wants to merge 1 commit into from
Closed

docs(TSP-1356): document MCP run-only access and Viewer role MCP support #733

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions enterprise/rbac.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@
| **Role** | **Capabilities** |
| ---------- | ------------------------------------------------------------------------------------------------ |
| **Owner** | Full control of organization, billing, security, users and all projects |
| **Admin** | Manage users, projects, organization-level API keys and OAuths |

Check warning on line 62 in enterprise/rbac.mdx

View check run for this annotation

Mintlify / Mintlify Validation (relevanceai) - vale-spellcheck

enterprise/rbac.mdx#L62 

Did you really mean 'OAuths'?
| **Member** | Access only assigned projects. Cannot create projects at organization level. Asset creation within projects is controlled by project-level permissions. |
| **Viewer** | View-only access to agent and tool audit logs, usage data and compliance reports |

Expand All @@ -70,7 +70,7 @@
| Manage billing | ✅ | ❌ | ❌ | ❌ |
| Manage organization settings (name, logo, domain etc.) | ✅ | ✅ | ❌ | ❌ |
| Manage organization users | ✅ | ✅ | ❌ | ❌ |
| Manage API keys & OAuths (Org-level connections) | ✅ | ✅ | ❌ | ❌ |

Check warning on line 73 in enterprise/rbac.mdx

View check run for this annotation

Mintlify / Mintlify Validation (relevanceai) - vale-spellcheck

enterprise/rbac.mdx#L73 

Did you really mean 'OAuths'?
| View global audit logs | ✅ | ✅ | ❌ | ❌ |
| View all projects and agents | ✅ | ✅ | ❌ | ❌ |
| Delete any asset | ✅ | ✅ | ❌ | ❌ |
Expand All @@ -97,7 +97,7 @@
| **Editor** | Can edit and create assets, does not manage users |
| **Member** | Use shared assets, provide inputs and view outputs. Can create assets, private by default. |
| **Chat** | Access [Relevance Chat](/get-started/chat/introduction) only - cannot access the web app. Requires asset-level permissions to run agents. |
| **Viewer** | View agents, tools, and knowledge outputs only, cannot run or edit anything |
| **Viewer** | View agents, tools, and knowledge outputs only, cannot run or edit anything. Can view and execute assets via MCP in run-only mode. |

<Info>
Editor is a project-level role only and does not exist at organization or asset levels. Project Editors automatically have Admin permissions on all assets within the project.
Expand All @@ -113,13 +113,13 @@
| :------------------------------------- | :-------- | :--------- | :--------- | :--------- | :------- |
| Delete project | ✅ | ❌ | ❌ | ❌ | ❌ |
| Assign project roles to users | ✅ | ❌ | ❌ | ❌ | ❌ |
| Manage project-level API keys & OAuths | ✅ | ❌ | ❌ | ❌ | ❌ |

Check warning on line 116 in enterprise/rbac.mdx

View check run for this annotation

Mintlify / Mintlify Validation (relevanceai) - vale-spellcheck

enterprise/rbac.mdx#L116 

Did you really mean 'OAuths'?
| Add personal OAuth accounts (dynamic auth) | ✅ | ✅ | ✅ | ✅ | ✅ |
| Delete agents | ✅ | ✅ | ❌ | ❌ | ❌ |
| View all assets by default | ✅ | ✅ | ❌ | ❌ | ❌ |
| Edit/run assets they did not create | ✅ | ✅ | ❌ | ❌ | ❌ |
| View project activity logs | ✅ | ✅ | ❌ | ❌ | ❌ |
| Manage personal Relevance API key | ✅ | ✅ | ✅ | ❌ | ❌ |
| Manage personal Relevance API key | ✅ | ✅ | ✅ | ✅† | ❌ |
| Create assets | ✅ | ✅ | ✅ | ❌ | ❌ |
| View Project | ✅ | ✅ | ✅ | ✅ | ❌ |
| Access Web App | ✅ | ✅ | ✅ | ✅ | ❌ |
Expand All @@ -130,9 +130,13 @@
</Info>

<Note>
"Manage project-level API keys & OAuths" refers to shared, project-wide accounts only. All team members can add their own personal OAuth accounts when [dynamic authentication](/enterprise/user-level-authentication) is enabled on a shared agent — this is not restricted to admins.

Check warning on line 133 in enterprise/rbac.mdx

View check run for this annotation

Mintlify / Mintlify Validation (relevanceai) - vale-spellcheck

enterprise/rbac.mdx#L133 

Did you really mean 'OAuths'?
</Note>

<Note>
† Viewer-role users can mint a personal API key as part of the [MCP OAuth consent flow](/integrations/mcp/mcp-server#oauth-consent-and-access-control). This is specific to MCP connections — Viewers are not granted general API key management. Viewers connecting via MCP are automatically placed in run-only mode and cannot create, edit, publish, or delete assets.
</Note>

### Chat Role Details

<Warning>
Expand All @@ -155,7 +159,7 @@
</Accordion>

<Accordion title="LLM conversations">
Can have conversations with LLMs and in-built Chat Agents directly without agents.

Check warning on line 162 in enterprise/rbac.mdx

View check run for this annotation

Mintlify / Mintlify Validation (relevanceai) - vale-spellcheck

enterprise/rbac.mdx#L162 

Did you really mean 'LLMs'?
</Accordion>

<Accordion title="More powerful than Viewer">
Expand Down Expand Up @@ -233,7 +237,7 @@
</Info>

<Tip>
Learn more about [sharing workforces](/build/workforces/share-your-workforce) as cloneable templates.

Check warning on line 240 in enterprise/rbac.mdx

View check run for this annotation

Mintlify / Mintlify Validation (relevanceai) - vale-spellcheck

enterprise/rbac.mdx#L240 

Did you really mean 'cloneable'?
</Tip>

----
Expand All @@ -258,7 +262,7 @@
</Card>
</CardGroup>

There was no asset-level granularity. All users with a given role had the same access to every asset in the project by default. Shared credentials (API keys, OAuths) applied project-wide.

Check warning on line 265 in enterprise/rbac.mdx

View check run for this annotation

Mintlify / Mintlify Validation (relevanceai) - vale-spellcheck

enterprise/rbac.mdx#L265 

Did you really mean 'OAuths'?

### During the migration

Expand Down
29 changes: 27 additions & 2 deletions integrations/mcp/mcp-server.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
</Accordion>

<Accordion title="ChatGPT" icon="comment">
ChatGPT supports MCP servers through Developer Mode, available on Pro, Team, Enterprise, and Edu plans.

Check warning on line 42 in integrations/mcp/mcp-server.mdx

View check run for this annotation

Mintlify / Mintlify Validation (relevanceai) - vale-spellcheck

integrations/mcp/mcp-server.mdx#L42 

Did you really mean 'Edu'?

1. Open ChatGPT **Settings**
2. Go to **Connectors** → **Advanced** → **Developer Mode**
Expand Down Expand Up @@ -172,7 +172,28 @@

## Authentication

When you first connect, you will be prompted to authenticate with your Relevance AI account. Authentication is **per project** — you will be connected to a specific Relevance AI project after logging in.
When you first connect, you will be prompted to authenticate with your Relevance AI account via an OAuth consent page. Authentication is **per project** — you will be connected to a specific Relevance AI project after logging in.

### OAuth consent and access control

The OAuth consent page lets you review the access being granted to the connecting AI client before completing authentication. It includes a **Run-only access** toggle that controls what the connected AI agent can do within your project.

When run-only access is enabled, the connected AI agent can view and execute agents, tools, and workforces — but write and delete tools are entirely absent from the MCP tool list (not just blocked; they do not appear at all). The agent cannot create, edit, publish, or delete any assets. When run-only access is disabled, the agent has the same capabilities your account role allows.

### Roles & access levels

Your project role determines the default access mode and whether you can change it:

| Role | Can connect via MCP | Default mode | Can toggle run-only |
|------|---------------------|--------------|---------------------|
| Viewer | ✅ | Run-only | ❌ (locked) |
| Member / Editor / Admin | ✅ | Full access | ✅ |

Viewer-role users are automatically placed in run-only mode — the toggle is locked for them and cannot be changed. Users with Member, Editor, or Admin roles connect in full access mode by default but can enable run-only access voluntarily on the consent page to limit what the connected AI agent can do.

<Note>
Viewer-role users can now connect to Relevance AI via MCP. Previously, only Editor-role and above could connect.
</Note>

### Working with multiple projects

Expand Down Expand Up @@ -326,6 +347,10 @@
</Accordion>

<Accordion title="Can I restrict which tools are available via MCP?">
The MCP server exposes the tools and agents available in the project you authenticated against. To control access, organize your tools across different projects and authenticate each connection to the appropriate project.
There are two ways to restrict MCP tool access.

The first is the Run-only access toggle on the OAuth consent page. When enabled, write and delete tools are entirely absent from the MCP tool list, so the connected AI agent can only view and execute assets. Viewer-role users are placed in run-only mode automatically. See [OAuth consent and access control](#oauth-consent-and-access-control) for details.

The second is project separation. Organize your tools across different Relevance AI projects and authenticate each MCP connection to the appropriate project.
</Accordion>
</AccordionGroup>
Loading