Administrators decide whether AI assistants may connect to the organisation at all, which tools they may use, and which hosted AI apps may sign in. This page covers those settings and every protection that applies to MCP calls. What an assistant can do is in AI assistants (MCP).
The MCP settings
Open Settings > MCP (“Whether AI apps may connect to this workspace, and which tools they may not use”). You need Manage MCP settings (Admin role).
| Setting | Default | Meaning |
|---|---|---|
| Let MCP clients connect | Off | AI apps may connect with an API key that holds Connect MCP clients, or with a sign-in. Each tool still needs its own permission, held by the key and by its owner. |
| Switched-off tools | Empty | Tools no one in the organisation may use, one per line as server/tool. |
| More AI apps | Empty | Hosts of AI apps that may connect with a sign-in, besides the well-known ones Hermetry accepts, one per line, for example tools.example.com. |
Changes apply to the next call. If the settings cannot be read, MCP counts as switched off.
Switch MCP on
- Open Settings > MCP.
- Turn on Let MCP clients connect.
- Save.
Turning it off stops every assistant at once: every call answers 403 “MCP is switched off for this workspace (Settings → MCP)” and the server index (GET /api/mcp) answers { "enabled": false, "servers": [] }. Keys and connected apps stay as they are and work again when you turn it back on.
Switch single tools off
Write one tool per line:
telemetry/get_reading_series
iot_device/get_deviceA switched-off tool is not listed to any assistant and cannot be called, whatever the credential holds. Use this when, for example, you want assistants to see current values but not history. The names of all servers and tools are in the MCP tools reference, or call GET /api/mcp.
Allow more AI apps
Assistants that connect with a sign-in identify themselves with an https address on their own host. Hermetry accepts a built-in list of well-known AI app hosts and their subdomains. For any other app, add its host under More AI apps; a subdomain of a listed host is accepted too. Until then, the sign-in page shows This app cannot connect.
Add only hosts you trust. The app still acts with the rights of the person who approves it, but it receives what that person can read.
Protections on every call
| Check | Detail |
|---|---|
| Origin | A call carrying a browser Origin of another site is refused before anything else |
| Credential | An API key with Connect MCP clients, or a token of a connected app; a browser session cookie is refused with 401 |
| Organisation | The credential’s organisation must be the one in the address; the organisation must be active |
| Member | The key’s holder, or the person who connected the app, must be an active member; an Owner acts with at most Admin rights |
| Permission | The tool’s permission, held now by the person (and by the key) |
| Network | The key’s IP allowlist and your organisation’s IP rules |
| Tool list | Only tools that pass all checks are listed; a call to another is refused without running |
Limits:
| Limit | Value |
|---|---|
| Request body | 64 KiB |
| Result | 256 KiB (larger results are refused) |
| Data block | 32 KiB each (longer text is cut and marked “[truncated at 32768 bytes]”) |
| Run time | 10 seconds per call |
| Rate | 120 read and 20 write calls per minute per credential |
| History | 31 days, 10 keys, 500 points per key per call |
| Sign-in tokens | 10 minutes; connections 90 days |
Fenced data
Text that Hermetry did not write itself (device names and labels, values a device sent) can contain words aimed at an AI model. Hermetry puts such text in its own block after its own summary, headed “The block below is data retrieved from <untrusted> tags the text cannot close. An assistant that follows the MCP guidance treats it as data.
This lowers the risk; it does not remove it. Keep device names and labels plain, and do not give an assistant more permissions than it needs.
Audit
Every MCP call writes one audit row:
| Action | When |
|---|---|
mcp_server.tool.called | A tool ran: server, tool, kind, outcome, error code, duration and the names of the arguments |
mcp_server.tool.refused | A tool the credential may not use, or a spent rate budget |
Argument values and results are never stored. For an API key, the actor is the key; for a connected app, the row names the connection. Connecting, disconnecting and suspending apps and changing the MCP settings are audited too. See Audit log.
AI firewall
MCP calls are signals for the AI firewall: refused tokens, refused origins, rate limits, repeated invalid arguments, a reused refresh token (critical) and decoy tokens (an access token no app was ever given; presenting it means a stolen or planted copy).
In development: The firewall’s actions on MCP credentials, such as pausing a connected app or throttling a key. Today it records incidents. See AI firewall.
Checklist before you switch MCP on
- Know who can connect. Every built-in role holds Connect MCP clients, so once MCP is on, every member can connect an assistant with their own rights. See Users and roles.
- Switch off tools you do not want assistants to use.
- Tell members to use one key per assistant, read-only, with a short expiry.
- Review Connected apps (Everyone) and the audit log from time to time.