Set Up the MCP Server
Turn on MCP connections, set the rate limit and find the MCP server URL. Every control is on Settings > General, in the Security card (click the card header to expand it), under External API access. The MCP server is read-only: nothing you switch on here lets an assistant change anything.
5 Sections
Jump to a section below.
Permissions
Changing these settings needs both Modify Settings and Manage Roles (the built-in Administrator role). Other users see the toggles disabled.
Turn On MCP Connections
Both Allow external API access and Allow MCP connections start off.
- Open Settings > General, expand the Security card and find External API access.
- Turn on Allow external API access, the master switch. MCP cannot work while it is off. It is described in full in External API: Getting Started.
- Optional: turn on Restrict API access to granted users. Each user or group then needs External API access turned on in their grant on Settings > Users. The same grant flag governs MCP and the scripting API.
- Turn on Allow MCP connections.
- Set Tool calls per minute (see Rate Limit).
- Click Save Changes.
MCP runs on top of External API access
The scripting API and MCP are independent switches under one master switch, and they share the trusted-client list and the per-user grant. With both on, a trusted client may use either. Turning MCP off leaves scripts working.
Rate Limit
Tool calls per minute appears while Allow MCP connections is on. It caps how fast one person's assistant can query StratoLens.
Defaults
- Tool calls per minute
- 60 (whole number from 1 to 600)
- Counted per
- User and client app, in a fixed 60-second window
- What counts
- Tool calls only, including ones the limit rejects. Connecting and listing tools are not counted.
Because rejected calls count too, an assistant retrying in a tight loop stays limited until the window ends. A change to the limit takes effect within about a minute.
The default suits interactive use
60 tool calls per minute is enough for a person chatting with an assistant. Lower it if you want to cap how hard any one user can query StratoLens.
MCP Server URL
The read-only MCP server URL field, with a copy button, appears once Allow MCP connections has been saved on. It has the form https://<host>/api/mcp and is the value your users give their AI assistant.
Copy the URL from the Security card
Don't take it from your browser's address bar. The two can differ (for example with a custom domain), and sign-in fails when the URL a client uses does not match the one StratoLens publishes.
When a Claude or ChatGPT client is trusted, a yellow warning can appear under the URL saying it is not an Application ID URI of the StratoLens App Registration. Those clients cannot sign in until it is fixed; see Connect a Client: Claude.
Trusted Clients
Only client apps on the Trusted clients list can connect. The table appears once Allow external API access has been saved on. Its Type column shows the preset, such as Claude or VS Code (GitHub Copilot). Click Add client to open the Add Trusted Client wizard, covered in Connect Your AI Assistant. Click a client's Name to see its connection instructions again.
Turning It Off or Revoking Access
- Allow MCP connections off
- MCP clients get "MCP connections are disabled by your StratoLens administrator." Scripts keep working.
- Allow external API access off
- Every external sign-in, scripts and MCP, is rejected.
- Remove a client
- That client's next call is refused with "Client <id> is not a trusted client for this StratoLens installation."
Each change applies within about a minute. Permission changes made on Settings > Users reach MCP users on their next tool call, without reconnecting; allow up to about 5 minutes.
Changes to these settings and to the trusted-client list are recorded in the audit log. Individual tool calls are not.