> For the complete documentation index, see [llms.txt](https://docs.spreo.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.spreo.io/boards/mcp/mcp-permissions-and-security.md). # MCP Permissions and security Who can connect an AI assistant to Spreo, what it can reach, and how to control it. ## Permissions and Security using MCP Server Who can connect an AI assistant to Spreo, what that assistant can reach, and how to control it. {% hint style="info" %} **While the Spreo MCP server is in beta, you must** [**manually add the connector**](/boards/mcp.md#connect-your-ai-assistant)**.** {% endhint %} ### What your assistant can access When you connect an AI assistant to Spreo, it acts as you. It sees exactly the boards and workspaces you see, and it can't reach anything you can't. It's bound to a single account: if you belong to more than one Spreo account you pick which one when you authorise, and the connection only covers that one. The tools expose no admin functions either, so connecting an assistant doesn't open up billing, member management or account settings. If your access changes, your assistant's access changes with it. Remove someone from a workspace and their assistant loses that workspace too. ### What you authorise Spreo uses OAuth 2.0. You're never asked to paste a password or an API key into your AI tool. When you connect, Spreo shows you what the assistant will be able to do: * Confirm who you are * See your profile: name, photo and email * See your workspaces and boards * Read, edit and create boards on your behalf You authorise it once. Your AI tool holds a token from then on, and Spreo can revoke that token at any time. ### Admin controls Owners and Admins control MCP for the whole account under **Manage**, then **Integrations**, then **MCP**. #### Allow or block MCP A single switch, **Allow account members to connect AI tools via MCP**, governs the entire account. Turn it off and no member can connect an AI tool. Any existing connection stops working immediately. It applies to everyone in the account, owners included. If your organisation isn't ready for AI tools to reach your boards, this is the control to use. #### See who has connected The **Connected members** table on the same page lists every member who has authorised an AI tool, showing the member, their email, which client they connected and when. It's worth checking during the beta to see what's actually in use across your account. ### Removing access If you're a member, open your Spreo profile, go to **Integrations**, and remove the connection. Access stops straight away. If you're an Owner or Admin, turn off the account switch under **Manage**, then **Integrations**, then **MCP**. That cuts off every connection at once. Either way, remove the connector in your AI tool as well, or it'll sit there showing an error. ### Where your board content goes Three separate things happen when you use MCP. 1. Your board content goes to your AI provider. When your assistant reads a board, that content leaves Spreo and goes to whichever AI tool you connected, where it's handled under that provider's terms rather than ours. The same is true in reverse: whatever you paste into your assistant can end up on a Spreo board. Choose your AI tool the way you'd choose any other processor of your team's data, and check your organisation's position before you connect. 2. Spreo records MCP activity. We log which tools were called, and whether they worked, so we can support the beta, diagnose problems and understand what people are trying to do. When your assistant reads a board, the content it gets back isn't stored in that log. 3. Generated images go through Spreo's image provider. When your assistant asks for an illustration on a board, the description it writes is sent to Google's image model, through Spreo's own account, to create the picture. This happens whether or not AI features are switched on in your AI Settings. Spreo doesn't use your data to train AI models. The [AI Addendum](https://spreo.io/legal/ai-addendum) has the detail. ### Beta Access to the Spreo MCP is by manually adding the Spreo MCP as a connector, using as the server URL. For everything else about Spreo's security posture, see [spreo.io/security](https://spreo.io/security). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.spreo.io/boards/mcp/mcp-permissions-and-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.