Tool access for your team
Tool access requires three layers working together.
Enable toolkit
Workspace admin adds the integration to the workspace catalogue.
Publish to group
Admin publishes the toolkit to a governance group.
Member connect
Member connects vendor credentials on their agent.
Enable tools
Member enables tools within their entitlement.
MCP invoke
Agent calls tools through governed meta-tools.
Platform catalogue toolkits
When CortexHub publishes a toolkit to the global catalogue, it becomes available for org admins to review. An org admin must enable the toolkit for this organisation before it can be published to a group.
For each group that should use a toolkit, open Groups → a group → Toolkits & Tool Access:
- Publish a toolkit entitlement (grant access).
- Configure allowed auth methods (subset of what the toolkit supports).
- Configure OAuth scope allowlists for OAuth-based toolkits. The org admin sees every scope the platform catalogue advertises; platform default scopes are pre-checked. Required scopes cannot be unchecked. On publish, the selected list is stored explicitly. Members see only that list (plus any required scopes) when they connect, not the full catalogue and not platform defaults unless the admin left those selected.
- Review access rules by safety profile on the published toolkit's Policies tab.
The default All staff group does not receive toolkits automatically: assign entitlements explicitly.
Custom toolkits
Org admins create custom OpenAPI toolkits under Toolkits → Add custom toolkit by uploading or fetching an OpenAPI/Swagger spec; tools are auto-discovered, classified, and indexed. Custom toolkits are org-scoped, enabled in the org on create, and follow the same group publish flow as catalogue toolkits.
What members do
Members connect toolkits once from the My space Toolkits page in CortexHub Cloud. That single member connection is reused by the member's co-worker and by external MCP clients that authenticate as that member. There is no per-agent attach or per-agent enable step. In supporting MCP clients, the in-chat Connect prompt completes the same member connection.
Org Agents use a different credential scope. Publish the toolkit to the Org Agent's group and configure an organisation-shared credential when the toolkit requires one; an Org Agent does not borrow a member's personal connection.
For bring-your-own OAuth or API key / bearer / basic toolkits, configure org credentials on the toolkit's Auth tab during publish before members connect. Members then complete OAuth in the popup or use the pre-configured method; they do not paste secrets into chat.
Members connect or disconnect whole toolkits. They do not enable individual tools: group entitlements decide which tools are available. A member can, however, tighten the access rules on their own connected toolkits and on their personal files from the toolkit's Policies tab in My space, never loosen them. See Policies and approvals. Effective access is:
group entitlement ∩ auth methods allowed for the group ∩ OAuth scopes granted at connect ∩ access rules at invoke
Troubleshooting member access
| Symptom | Likely cause |
|---|---|
| Toolkit missing from connect list | Not entitled to member's group, or not enabled for the org |
| Auth method missing from connect picker | Not in group auth-method allowlist |
| Tool disabled with reason | Policy deny or outside entitlement |
| Connect button blocked | OAuth scopes exceed group allowlist |