Skip to main content
Access in Port of Context is decided in three places: which services the workspace and its teams get, whose credentials a service uses, and who a source or map node is shared with.

​
Choose who gets a service

Open Admin → MCP servers. Each server has an audience button that reads Everyone, a count of teams, or Off. Rules apply to a whole service and to teams. You cannot set a rule for one person. When more than one rule applies to a person, they resolve in this order:
  1. If the service is off for the workspace, nobody gets it.
  2. A person on no team gets the workspace setting.
  3. A person on several teams gets the service if any one of their teams has it.
Limiting a service to some teams needs the Team or Enterprise plan. Changes take effect the next time an agent starts a session with the gateway.

​
What a member sees

A service a member is not allowed to use does not appear in their agent’s tool list, and a direct call to it is refused. If the service is allowed but the member has not connected their account, the agent is told to connect it in Port of Context.

​
Whose credentials a service uses

Admins cannot read a member’s credentials. Admins can see usage across the workspace on the Insights page, including which member called which tool. Members see only their own activity.

​
Share an indexed source

Open the source and select Manage access. The button appears for the person who created the source and for admins.
  • Organization lets everyone in the workspace search it. This is the default.
  • Restricted keeps it private to its owner until you add people or teams.
  • Publishers lists the service accounts allowed to publish new content to it. A publisher can replace the content but cannot change settings or sharing.
Any admin or member can add a source.

​
Share a map node

Map nodes are visible to the whole workspace unless you restrict them. Open a node and select Manage access to limit it to people or teams. Admins and the node’s owner can do this, and it needs the Team or Enterprise plan. See Curation for who can edit the map.

​
Limit browser access to your MCP servers

Open Admin → Security to list the browser origins allowed to call your gateway and admin MCP from a web page.
  • Until you add an origin, every origin is trusted.
  • Once you add one, only listed origins are allowed. Localhost is always allowed.
  • Agents and other clients that are not web pages are unaffected.
  • Removing every origin returns to trusting all of them.