AI apps such as Claude, ChatGPT, and Microsoft Copilot connect to Egnyte through the Egnyte MCP Server. The MCP Server offers these apps a set of tools, for example searching for files, reading a file, creating a folder, or creating a share link.
With Tool access, administrators choose which of those tools each user or group can use. A tool that's switched off disappears from that user’s AI app interface, and Egnyte refuses any request that tries to use it anyway.
- Tool access controls which tools are available. It does not change Egnyte permissions. Every tool continues to respect the user's folder permissions and domain's link sharing settings.
- Only administrators can view and change Tool access settings.
- Administrators always have access to every tool irrespective of the settings.
- Tool access control is available on New Gen Essential, Elite, and Ultimate plans and legacy Platform Plans with AI Add on. Contact the Egnyte account manager or Egnyte Sales team for more information.
How Tool Access Works
General access sets the default MCP Server access for all users:
- Public: All users with MCP Server access can use all tools by default. Users and groups added to the list are limited to the tools assigned to them.
- Restricted: Only the users and groups added to the list can use MCP Server tools. All other users have no access to the tools.
Each tool is classified as Read or Write. Read tools retrieve content, while Write tools create or modify content, such as Create Folder, Upload File, and Create Link. Read and Write tools can be controlled separately, so users can be given read access without allowing their AI applications to make changes.
Ask AI Assistant and Ask Agent are added as Write tools, because they can generate documents and take actions. An admin who disables write tools to make a group read-only will lose those two as well.
If a user belongs to multiple groups in the access list, the user can use all tools allowed for any of those groups. Switching a tool off for one group doesn’t remove it from a member of another group that allows it. To block a specific person, switch the tool off on that user’s entry, which is prioritized over their groups.
Navigate and Configure Tool Access
- Navigate to Settings -> AI Powered Features -> MCP Server
- Configure Tool access with General access by clicking on Public (default) or Restricted.
- Click on Switch to confirm. Switching between Public and Restricted does not remove access for every user and group already added in the settings.
Switching to Restricted with no users or groups in the list removes MCP Server tools from every non-admin user right away.
Add Users and Groups
- Select Add, next to Restricted users and groups (Public) or Users and groups with access (Restricted).
- In User or group, type at least two characters and select a user or a group. Built-in groups such as All Power Users are available too.
- Use respective toggles to configure a specific tool or click on the Bulk actions dropdown to enable or disable tools in bulk. Admins can also search for the specific tool to configure. Click on Save.
- Tool access list displays the list of user(s) and group(s) with their tool access. Each row shows the tools assigned to that entry. A user’s actual access combines every entry that applies to them and their groups.
Edit Tool Access
- Hover over on any user or group and click on the edit icon. Alternatively, click on the three-dots icon -> Edit.
- Make the desired edits and click on Save.
Delete Tool Access
- Hover over any user or group and click on the delete icon. Alternatively, click on the three-dots icon -> Delete.
- Click on Remove access to confirm. With Public access, removing a restriction gives that user or group every tool again right away, if no other entry, such as one of their groups still applies. For restricted, removing an entry takes those tools access right away.
Notification for New Tools
When a new tool becomes available on the MCP Server, Tool access shows a notification for it. Admins can review the users and groups in their list and configure the tool access for them, as needed.
Tools Accessible to End-Users
Tools that are switched off do not appear in the AI app's list of Egnyte tools. In the example below, Read-only tools are displayed when write tools are disabled.
If the user asks the AI app to do something that needs a tool that's switched off, it cannot perform the associated action.
If an app calls a switched-off tool anyway, Egnyte refuses the request with this message:
Tool '<tool name>' is not available under your organization's access policy. Contact your Egnyte admin.If the admin makes any changes to the tool access, these changes apply to the next request; users don't need to sign in again. Some AI apps keep a copy of the tool list, so users may need to refresh it to see the change. In Claude, open the Egnyte connector and select the Refresh tools list.
Any changes to Egnyte group membership can take up to an hour to apply on the Tools access. For example, a user added to a restricted group will have access to their tools for up to an hour.