Overview amber MCPs / Apps

Roles & Permissions Overview

How MCP servers are managed in amber depends on the role assigned to each user. There are three relevant role levels:

• Administrator – Can add and configure MCP servers that are made available globally to all users in the organization.

• Developer – Can add personal MCP servers that are only visible and available to themselves.

• Standard User – Can connect to MCP servers that have been globally configured by an Administrator, and can manage permissions for individual tools.

How Global MCP Configuration Works

This two-step process ensures that:

• Administrators maintain full control over which MCP integrations are available within the organization.

• Users can self-service their own connection with a single one-time action.

• No sensitive credentials need to be shared between Administrators and individual users.

The workflow looks like this:

1. Administrator configures the MCP server once under Admin Settings → Connectors → Apps.

2. The MCP server is now globally visible to all users in the organization.

3. Each user connects to the MCP server once under User Settings → Connectors → Apps.

4. The MCP server's tools are now available in that user's amberAI conversations.
   

Adding Global MCP Servers (Administrators)

As an Administrator, you have the ability to configure MCP servers that are instantly made available to your entire organization. This is the recommended way to roll out MCP integrations, as it ensures all users have access to the same tools without needing individual technical setup.

Navigate to Admin Settings → Connectors → Apps and click Add MCP. Fill in the following details:

• Name – A descriptive name for the MCP server

• Description – A short explanation of what the server does

• Server URL – The public URL of the remote MCP server

• Authentication method – OAuth, Bearer token, or custom headers (depending on the server)

After filling in the form and accepting the terms, click Add Custom MCP to test the configuration and save the server. If no custom icon is provided, it will be fetched automatically from the server URL.

Currently, only remote MCP servers accessible via a public URL are supported. Authentication options include OAuth, Bearer tokens, or custom header-based authentication. Servers without authentication can be connected by simply providing the public URL

Adding Personal MCP Servers (Developer Role)

Users with the Developer role (can be assigned by administrator) can add MCP servers for their own personal use without requiring admin permissions. These servers are exclusively available to the user who added them and are not visible to or shared with the rest of the organization.

To add a personal MCP server, go to User Settings → Connectors → Apps and click Add MCP. The configuration form is identical to the admin version. Fill in the name, description, server URL, and authentication method, then click Add Custom MCP to finalize the setup.

Additionally, we have now support for adding custom MCP servers. This means you can bring your own configuration to connect to any application you want, as long as you have the necessary credentials and the application provides an API that can be connected to. This allows for a lot of flexibility and opens up many possibilities for integrating various applications with amberAI.

In the current version, we only support connecting to remote MCP servers via a public URL. To connect to a remote MCP server, you can use OAuth-based authentication, Bearer tokens, or through a custom headers-based authentication, depending on the authentication methods supported by the MCP server you want to connect to. If the MCP server does not require authentication, you can simply connect to it by providing the public URL.

Configuring MCP Tools

Both Administrators and Developer users can configure the individual tools provided by an MCP server. Available options include:

• Enabling or disabling specific tools

• Renaming tools for clarity

• Setting the tool type to Read Only or Write

Configurations made by an Administrator apply to all users organization-wide. Configurations made by an individual user apply only to themselves.

Connecting to an Admin-Configured MCP (Standard Users)

Once an Administrator has set up an MCP server, it is globally available to you – but you need to connect to it once before you can use it. This one-time step links your personal account to the MCP server and activates its tools in your conversations.

To connect, go to User Settings → Connectors → Apps. You will see all MCP servers that your Administrator has made available. Click Connect on the relevant server to complete the setup. From this point on, the server's tools will be available in your amberAI conversations.

Example: Adding MCP Servers (for Admins)

The option to add MCP servers can be found in Admin Settings -> Connectors -> Apps.

The internal MCP servers for Outlook and Slack are already added and available for all users. To add a new MCP server, you can simply click on the "Add MCP" button. This will open a form where you can enter the details of the MCP server you want to add, such as the name, description, the server URL and authentication method.

Here's an example of how to fill the form to add the Microsoft Learn MCP server:

After filling the form and accepting the terms, you can click on the "Add Custom MCP" button to test the configuration and add the MCP server. If you didn't add a custom icon, it will be fetched automatically from the server URL. Once the MCP server is added, it will show up under the Apps section and will be available for users to connect to.

For OAuth, you will be redirected to the authentication flow of the MCP server you are trying to connect to. This step is necessary to retrieve all the tools and capabilities provided by the MCP server and store their configurations in amberAI. Please note that after the initial setup, each user will still need to connect to the MCP server individually through their profile settings to use the tools provided by the MCP server in their conversations.

Configuring MCP Servers (for Admins)

As an admin, you can configure the MCP server you added to enable or disable certain tools, change the tool names, and change the tool types (Read Only or Write Only). If done as an admin, these configurations will be applied for all users. If done as a user, these configurations will only be applied for that user.

Permissions (for Users)

Users can also configure the MCP servers they are connected to. Once you open up a specific MCP server in your user settings, you will see the list of tools provided by that MCP server. For each tool, you can change the permission to either Always allow, Always ask, or Always deny, which is set to Always ask by default. This allows you to have control over which tools you want to allow or deny for use in your conversations. For example, you might want to allow the microsoft_docs_search tool from the Microsoft Learn MCP server, but deny the microsoft_code_sample_search tool for avoiding unwanted results. The changes you make in the permissions will be applied immediately and will affect the conversations you have with amberAI. If you set a tool to Always allow, amberAI will be able to use that tool without asking for your permission every time. Please be cautious when setting permissions to Always allow, especially for tools that can perform write actions, as this might lead to unintended consequences if the tool is used in a conversation without your explicit consent.

Using MCPs in amberAI

Once you have added and connected to an MCP server, you will see the server under the Apps in the options section of the chat input. You can toggle the MCP server on to make its tools available for use in the conversation.

When amberAI decides to use a tool from an MCP server in the conversation, it will check the permissions you have set for that tool. If the permission is set to Always ask, you will receive a notification in the conversation asking for your permission to use that tool. You can then choose to allow or deny the use of that tool for that specific instance in the conversation. If you allow it, amberAI will proceed to use the tool and provide you with the results. If you deny it, amberAI will not use the tool and will act accordingly in the conversation.