# Enable MCP and manage connected apps > Turn MCP on for a workspace, approve specific AI apps, review connections and access tokens across all members, and read the usage analytics and activity log. - Product: Workspace369 - Documentation version: 2026.3 - Section: AI connections - Last updated: 2026-09-07 - Canonical source: https://docs.workspace369.com/v/2026.3/ai-connections/enable-mcp-and-manage-connected-apps/ --- MCP is off for every workspace until an admin turns it on. The **AI Connections (MCP)** screen is where you enable it, decide which apps may connect, see who has connected what, and audit every call an AI app has made. ## Before you begin - You need the **Manage MCP connections** permission, found under Workspace AI in a member's permissions. The workspace owner and admins have it. - The workspace needs Tokens. Every successful MCP call is paid from the workspace's Token balance, and a call is refused when the balance cannot cover it. ## Open AI Connections (MCP) 1. Open **Settings**. 2. Under the **AI** category, choose **AI Connections (MCP)**. The screen is organized top to bottom: the on/off switch, the connection card, connected apps, approved apps, access tokens, usage analytics, and the activity log. ::app-screenshot --- src: /screenshots/2026.3/ai-connections/ai-connections-mcp-settings-with-enable-switch-and-server-url-ipad-light.png alt: Workspace369 AI Connections (MCP) settings with the Enable MCP switch turned on, the Connect an AI app card showing the MCP server URL, and the Connected apps, Approved apps, and Access tokens sections caption: With MCP on, the Connect an AI app card shows the server URL to share. The sections below it are where you review who has connected, restrict apps, and revoke tokens. meta: Workspace369 2026.3 · iPad · Light mode cropTop: 2.6 cropLeft: 42 --- :: ## Turn MCP on or off 1. At the top of the screen, turn on the switch. The card reads "When on, members can connect AI apps (Claude, ChatGPT, Cursor…) to this workspace via MCP." 2. The **Connect an AI app** card appears with the server URL. Share it with members who want to connect. Turning the switch off refuses every call from every connected app within about 30 seconds. The connections themselves are kept, so turning MCP back on restores them without anyone reconnecting. To remove access permanently, disconnect the apps as described below. ## Review connected apps **Connected apps (all members)** lists every app any member has authorized. Each row shows the app, when it was last used, and a **Disconnect** button. - **Disconnect** removes one app's access. The member can reconnect it later. - **Disconnect all apps** removes every connection across all members. The confirmation warns that every connected AI app will lose access. A member's own connections also appear in their Account settings, where they can disconnect them without an admin. ## Approve specific apps By default any MCP app a member chooses may connect. **Approved apps** lets you restrict connections to a list you control. 1. In **Approved apps**, choose **Approve an app**. 2. Under **Connected to this workspace**, tap the app to approve it. To approve an app before anyone has connected it, enter its **Client ID** instead and choose **Approve**. The client ID is the identifier the app registers with; the app's documentation or its entry in the connected-apps list shows it. ::app-screenshot --- src: /screenshots/2026.3/ai-connections/approve-an-ai-app-by-client-id-dialog-ipad-light.png alt: Workspace369 Approve an app dialog in the AI Connections (MCP) settings, asking for an AI app client ID with Cancel and Approve buttons caption: Before any app has connected, the dialog asks for the client ID so an app can be approved ahead of time. Once apps have connected, they are listed here to tap instead. meta: Workspace369 2026.3 · iPad · Light mode cropTop: 34 cropBottom: 34 cropLeft: 30 cropRight: 30 --- :: Once the list has at least one entry, only listed apps can make calls. The restriction is checked on every call, so removing an app with **Remove approval** takes effect within about 30 seconds even if the app still holds a valid connection. Removing the last entry returns the workspace to allowing any app. > Approval is about which apps may connect. It does not widen what an app can do: every call is still limited by the permissions of the member who connected it. ## Review access tokens **Access tokens (all members)** lists the personal access tokens members have created for scripts and agents, with the owner, scopes, expiry, and last use. These tokens do not appear in the connected-apps list, so check both when you want the full picture of who can reach the workspace. Choose **Revoke** on a token to end it immediately. A revoked token cannot be restored; the member creates a new one if they still need it. Members create and revoke their own tokens in Account settings. See [Personal access tokens for scripts and agents](/v/2026.3/ai-connections/personal-access-tokens/). ## Read usage analytics **Usage analytics** summarizes MCP activity for a window of 7, 14, 30, 60, or 90 days: - **Total calls** and **Tokens spent** on MCP calls. - **Error rate**, the share of calls that were refused or failed. - **Active connections**, meaning apps that made at least one call in the window. - A **Daily tool calls** chart and a **Top tools** table with calls and Tokens per tool. Calls made by Ask AI inside the app appear here too, with zero Tokens, because tool calls inside an Ask AI conversation are not charged individually. When a period holds a very large number of events the screen notes that it is showing a capped sample and that totals may not reflect all activity. ## Read the activity log The **Activity Log** sits at the bottom of the screen, collapsed until you expand it. It is the itemized trail: "Every tool call an AI app made in this workspace, including the ones that were refused." Each entry shows the tool that was called, the app that called it, when, and the Tokens it charged. A refused call shows the reason it was refused. Behind each entry Workspace369 also records the member whose authorization was used, the scope the tool required, how long the call took, and which argument fields were passed. Argument values, such as names, amounts, or message text, are never stored. Refused calls are kept deliberately, so the log can answer "what did the app try to do?" as well as "what did it do?". ## Notifications when a member connects an app When a member connects a new app, the workspace owner receives a notification naming the app and the number of permissions it was granted, with a reminder that it can only access what that member can. No notification is sent when the owner connected the app themselves. ## When a member leaves Removing a member from the workspace ends their MCP access immediately. Their connections are revoked automatically and disappear from the connected-apps list, so nothing needs to be cleaned up by hand. ## Verify the setup 1. Confirm the switch on **AI Connections (MCP)** is on and the server URL is visible. 2. Connect an app yourself and ask it for the workspace summary. See [Connect an AI app to your workspace](/v/2026.3/ai-connections/connect-an-ai-app-to-your-workspace/). 3. Check that the call appears in the **Activity Log** with a successful outcome and a Token charge. 4. If you restricted connections, confirm the app you connected is listed under **Approved apps**.