MCP Clients
The MCP Clients settings allow administrators to manage external applications that connect to AskSenseOps through the Model Context Protocol (MCP). Administrators can control client registration, restrict access to approved users, configure tool-level permissions, and review MCP activity.
To open these settings, navigate to Admin, then select MCP clients under Operations.
The page contains four tabs: Access, Clients, Tool Access, and Audit.
Access
The Access tab controls MCP availability, external client registration, and which users are permitted to authorize clients. Changes apply within seconds without requiring a server restart.
Service
The MCP enabled (org master switch) setting controls whether MCP is available across the organization.
- On: MCP is enabled, allowing connections according to the configured access rules.
- Off: New connections are blocked, and active sessions stop within seconds.
Client apps
The Require approval for new clients setting determines whether newly registered client applications need administrator approval.
- On: New client registrations require approval before they can connect.
- Off: New clients are automatically approved unless a sanctioned-host rule specifies otherwise.
Sanctioned host rules
Sanctioned host rules control how client applications are handled during registration. Rules are disabled until explicitly enabled.
The table includes the following fields:
| Field | Description |
|---|---|
| Name | Identifies the client application covered by the rule. |
| Match | Defines how the application is matched, such as by a redirect URI prefix or a name containing specific text. |
| Pattern | Specifies the value used for matching. |
| Action | Determines whether a matching registration is automatically approved or blocked. |
| On | Enables or disables the rule. |
The page includes predefined rules for ChatGPT (OpenAI), Claude (Anthropic), Cursor, and Microsoft / Copilot Studio. Administrators can add additional rules or delete existing ones.
A block rule refuses registration. An auto-approve rule allows a matching host to bypass the pending approval queue. Matching uses the redirect URI or origin, depending on the rule configuration. The client name is self-asserted.
Who is allowed
The Restrict to an allowlist setting limits which users may authorize an MCP client.
- Off: Any registered Qlik user may authorize a client.
- On: Authorization is restricted to users specified in the allowlist.
Use this setting when MCP access should be limited to an explicitly approved group of users.
Clients
The Clients tab displays registered external applications and provides controls for managing their access.
The page helps administrators review which applications access data through MCP and which client hosts they use. Available management areas include per-user actions, such as blocking a user or signing them out, and per-host registration management, including approval, disabling, and cleanup.
If no applications have registered, the page displays an empty state. Clients appear after they register through OAuth.
Select How to connect a client to view the connection instructions for supported client applications. Refer to the MCP Integration Setup section in the Installation documentation for the connection procedure.
Tool Access
The Tool Access tab controls what each registered MCP client can do for each connection.
Access rules determine whether a client can perform read-only operations, read and write operations, or all permitted operations. These rules govern capabilities rather than the underlying data. Qlik section access and row-level security continue to determine which data the signed-in user can see.
Enforcement
The Enforce tool access rules setting determines whether configured rules are actively applied.
- On: Rules are enforced for every tool call. Enforcement is fail-closed, meaning a call is denied when access cannot be established. Changes apply within seconds without requiring a restart.
- Off: Rules are saved for auditing purposes, but they do not block tool calls. Calls are still logged.
Tool access rules apply to registered clients. If no clients have connected, the page displays an empty state.
Audit
The Audit tab provides a record of tool calls made by external MCP clients, including both allowed and denied calls.
The audit view records which tool was called, who called it, and the outcome. Tool arguments and results are not stored.
Filters
Use the available filters to narrow the activity displayed:
- Time range: Defaults to the last seven days.
- Client: Filters activity by client application.
- Outcome: Filters activity by the result of the tool call.
The audit page displays matching MCP activity within the selected time range. If no calls match the selected filters, an empty-state message is displayed.
Regularly reviewing audit activity helps administrators monitor MCP usage and investigate denied or unexpected tool calls.