mdbase MCP
Collections and access
How approvals work, how to add or reconnect collections, and how to take access away.One approval per collection
The client does not get general access to your account. Each collection is approved on its own, with its own list of operations. There is no query or write that spans collections, and no collection is used unless you approved it.
Connection IDs
list_connections returns one entry for each approved collection:
| Field | Meaning |
|---|---|
id | The connection ID. Every collection tool requires it as connection_id. |
collection_id | The collection's ID in Connect. |
display_name | The collection name shown in Connect. |
operations | The operations you approved, such as read, query or update. |
authority | local when the collection is on your computer, remote when it is hosted. |
Connection IDs are opaque. They are not collection paths and do not reveal where the collection is stored.
Connect more collections
Ask the client to connect another collection. It calls add_connection, which returns a link for you to open in a browser. The link can be used once and expires after ten minutes.
The link opens the same Connect approval screen as the first setup. Choose the collection and its operations, approve, then ask the client to list collections again.
Reconnect or broaden access
If a collection's approval expires, or you want to allow operations you previously left out, the client calls reconnect_collection with that connection ID. The returned link opens Connect on that collection only. You review and approve its operations, or decline.
Read and write access
Two separate approvals control writing. The first is the MCP sign-in scope the client requests: mdbase:read, mdbase:write, or both. A client that does not ask for a specific scope gets both. The client only sees the write tools when the scope includes mdbase:write.
The second is the set of operations you approve for each collection in Connect. This one decides what can actually happen. If you approved a collection for reading only, a write tool fails with insufficient_collection_access. It never expands your approval by itself. If you narrow access in Connect, calls may fail with a different code until the MCP server's sign-in next refreshes, within an hour.
Revoke access
Open the Applications page in the Connect workspace. The MCP server is listed as mdbase. You can narrow or revoke its access to each collection there. The next tool call for a revoked collection fails, and other collections keep working.
Removing the server from your MCP client stops that client from using it, but does not remove the approvals held in Connect. Revoke them in Connect as well if you no longer use them.
Collections on your computer
For a collection that stays on your computer, requests travel from the MCP server through the Connect relay to the Connector. They are encrypted end to end between the MCP server and your Connector. The Connector checks its own copy of your approval before it opens the collection, so a grant you revoked is refused locally too.
The Connector must be running and online. If it is not, tools return connector_offline. See Troubleshooting.