AI agents (MCP)

Connect an AI client to the data and work you choose to share with it.

AI agents overview

Every plan, including Free, includes MCP. Free owners can make the same permitted changes as in the UI; Viewers cannot write. Paid scans, content briefs and prompt generation remain subject to paid-plan gates and quotas.

An MCP connection lets a compatible client read permitted data and perform allowed work, such as updating context or handling tasks and campaigns. Permissions, company plans, roles and review rules determine what it can do. You can continue using the browser alongside an agent.

Use this guide to find connection settings and access controls. Client setup, tool descriptions and technical examples live in the Supasaito MCP overview and the app’s current MCP reference.

Find the connection method your client supports

Open MCP & API tokens in Settings. The screen shows the endpoint and explains OAuth and personal access tokens. OAuth uses browser sign-in and an access-consent screen. A personal token is a secret the connection owner creates and stores for the client.

Connection availability is checked across your companies and eligible Service access, not only the company currently selected in the browser. Seeing a connection option does not grant access to every company. Follow the MCP reference for setup rather than copying a tool catalog from this guide.

Choose a personal or an agent connection

Every token and OAuth connection has a type, chosen when you create it under Token type (on the OAuth consent screen, Access type):

• Personal acts as you. Work for people, tasks assigned to you and reviews are done in your name, and history shows you, with the connection that carried the call recorded.
• Agent is an autonomous participant with its own Agent name and avatar. Tasks, the work log, campaigns and history show it that way, and its card names you as the owner. An agent can never do more than you are allowed to.

The type cannot be changed later; an agent’s name and avatar can. Connections created before the type existed are agents. Use a separate agent for each independent participant so that its work stays distinguishable.

Choose and review the permitted resources

Select the companies and brands the connection needs and allow only the required actions. Future companies and brands are excluded unless you explicitly include them. Service conversations have a separate permission selection.

Use Edit permissions to review an existing token or connected app’s permissions. Older connections may have broader legacy permissions; inspect their scope before relying on it. Permission edits do not bypass your role, company limits or task-review rules. Selected permissions are an upper limit: each call is still checked against your current role, the company’s MCP setting and plan, and a permission you do not hold yet is marked as not in effect.

Revoke a personal connection or block it for a company

In your personal connection settings, Revoke revokes a token and Connected apps (OAuth) lists authorised apps whose access you can revoke. Personal revocation disconnects the credential or app across its granted scope.

A company Owner or Admin can instead restrict a connection only for their company in History & Access, including blocking all of a member’s current and future MCP connections. That is separate from changing their human Team membership.