Permissions and access
Know what a connected client can do and how to revoke it.
One workspace per OAuth connection
OAuth access is limited to the workspace selected during consent. Every call checks your current membership and existing role. Viewers can read; they cannot mutate workspace data.
Local stdio uses your Uno user session and existing memberships. It does not use the hosted OAuth workspace grant.
What you authorize
The MCP catalog covers tasks, sessions, conversations, outputs, planning documents, agents, rules, skills, prompts, environment manifests and files, sandbox preparation, loops, routines, reviews, and approval actions.
Starting execution, preparing infrastructure, or enabling recurring work can consume credits. Review these permissions in the consent screen before approving the connection.
What is excluded
The server does not expose account identity changes, workspace creation or membership changes, repository attachment/removal, API keys, secret management, billing, integration authorization, or workspace MCP connection management.
An OAuth token for Uno MCP cannot be used as an ordinary Uno API credential. Workspace session API keys cannot authenticate the hosted MCP endpoint.
Revoke access
Open MCP connections and revoke the client. Existing MCP access is blocked and its OAuth grant is revoked. Reconnect to choose another workspace.
If an old connection needs updated automation consent, revoke it and reconnect. Refreshing a client-side tool list does not approve broader permissions.
Removing access to a client does not erase completed work. Inspect sessions and any scheduled work separately if you want to stop ongoing or future execution.