> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pctx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the exact commands, endpoints, and product terms in these docs. Commands that start with `pctx` mean the Port of Context platform CLI installed from pctx.ai, not the open-source tool of the same name.

# Access and sharing

> Control which teams get each service, who supplies credentials, and who can see sources and map nodes.

Access in Port of Context is decided in three places: which services the workspace and its teams get, whose credentials a service uses, and who a source or map node is shared with.

## Choose who gets a service

Open **Admin** → **MCP servers**. Each server has an audience button that reads **Everyone**, a count of teams, or **Off**.

| Setting | Effect |
| - | - |
| **Off** | Nobody in the workspace gets the service. Built-in services start here until an admin turns them on. |
| **Everyone** | Every member gets it. |
| Selected teams | Untick a team to remove the service from that team. |

Rules apply to a whole service and to teams. You cannot set a rule for one person.

```mermaid theme={null}
%%{init: {'flowchart': {'nodeSpacing': 28, 'rankSpacing': 34}}}%%
flowchart TD
    Q(Does this member get the service?) --> O(Off for the workspace?)
    O -- Yes --> N(No)
    O -- No --> T(Is the member on a team?)
    T -- No --> Y(Yes):::hub
    T -- Yes --> A(Does any of their teams have it?)
    A -- Yes --> Y
    A -- No --> N
```

When more than one rule applies to a person, they resolve in this order:

1. If the service is off for the workspace, nobody gets it.
2. A person on no team gets the workspace setting.
3. A person on several teams gets the service if any one of their teams has it.

Limiting a service to some teams needs the Team or Enterprise plan. Changes take effect the next time an agent starts a session with the gateway.

### What a member sees

A service a member is not allowed to use does not appear in their agent's tool list, and a direct call to it is refused. If the service is allowed but the member has not connected their account, the agent is told to connect it in Port of Context.

## Whose credentials a service uses

| Service type | Credentials |
| - | - |
| Built-in services that sign in with OAuth | Each member connects their own account under **My Connections**. No admin approval is needed. |
| Custom servers that use an API key | The admin chooses. Tick **Organization-managed key** to supply one key for the workspace, or leave it unticked so each member enters their own. |

Admins cannot read a member's credentials. Admins can see usage across the workspace on the **Insights** page, including which member called which tool. Members see only their own activity.

## Share an indexed source

Open the source and select **Manage access**. The button appears for the person who created the source and for admins.

* **Organization** lets everyone in the workspace search it. This is the default.
* **Restricted** keeps it private to its owner until you add people or teams.
* **Publishers** lists the service accounts allowed to publish new content to it. A publisher can replace the content but cannot change settings or sharing.

Any admin or member can add a source.

## Share a map node

Map nodes are visible to the whole workspace unless you restrict them. Open a node and select **Manage access** to limit it to people or teams. Admins and the node's owner can do this, and it needs the Team or Enterprise plan.

See [Curation](https://docs.pctx.ai/administration/curation.md) for who can edit the map.

## Limit browser access to your MCP servers

Open **Admin** → **Security** to list the browser origins allowed to call your gateway and admin MCP from a web page.

* Until you add an origin, every origin is trusted.
* Once you add one, only listed origins are allowed. Localhost is always allowed.
* Agents and other clients that are not web pages are unaffected.
* Removing every origin returns to trusting all of them.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.