Access modes & tool catalogs
Two independent switches that control what an instance exposes.
Each MCP instance has two independent settings.
Access mode
| Mode | Effect |
|---|---|
READ_ONLY | Filters the exposed set to read-only operations |
FULL_ACCESS | Exposes reads and writes |
Read-only is enforced on the server at both tools/list and execute time, and it blocks
writes attempted through <prefix>_raw_operation. A client cannot route around it.
Catalog scope
| Setting | Effect |
|---|---|
| Curated (default) | A hand-picked, high-value toolset for that provider |
| Full catalog | Every mapped operation the provider exposes |
Curated is the better default. A smaller tool list means the model picks the right tool more
often. Turn on the full catalog when you know you need breadth, or use search_tools to
reach specific operations on demand without switching.
What a given person actually gets
Both settings are resolved per member, per connector, on every request. Three layers apply in order, and each one can only narrow what the last one allowed.
The instance's own setting
The connector's own configured access mode and catalog scope. This is the starting point.
The member's override, if one exists
An owner or admin can override both per member, per connector, in the workspace Members panel. When no override exists, the connector's own setting applies unchanged.
A newly granted connector defaults to least-privilege READ_ONLY for that member, even when
the instance itself is set to full access. An OWNER never has overrides applied and always
uses the instance's own mode.
The plan's ceiling
The organization's entitled plan clamps the result. The Free tier exposes neither write operations nor the full catalog.
This layer only ever narrows. A plan can take a capability away from an instance that has it
configured, but it can never grant one the instance does not have — a connector deliberately
set to READ_ONLY stays read-only on every tier.
The clamp is applied when the tool list is built, not when a call is executed. An operation
the caller is not entitled to never appears in tools/list at all, rather than appearing
and then failing.
Grant read-only first, confirm the agent behaves, then widen.