Skip to main content
This guide explains the operational setup for coaches and company admins who control company/coach MCP access. Client MCP access is different: it is approved by the client in the client portal OAuth flow, requires the company mcp feature, requires client AI access to be enabled for that client-company relationship, and is limited by the company client MCP policy to explicit client_ai_* modules. See Client AI Access for that surface.

​
Prerequisites

The coach creating or approving the grant must:
  • have active access to the company
  • hold a Manager or Admin role
  • have access to the MCP settings in the coach dashboard
The company must also have the mcp feature enabled. If the feature is not enabled, MCP requests fail with COMPANY_MCP_FEATURE_DISABLED.

​
Enable the MCP feature

MCP must be enabled for the company before grants can be used. Depending on the deployment, this may be controlled by FITsociety support, an internal admin panel, or company feature settings. If you see COMPANY_MCP_FEATURE_DISABLED, ask the workspace or FITsociety admin to enable MCP for the company.

​
Create a grant

A grant defines what an AI client can access. For a static company MCP API key:
  1. Open the company MCP settings.
  2. Create a new MCP grant.
  3. Give the grant a clear name, such as Claude - read-only client review.
  4. Choose an expiry period.
  5. Select allowed modules.
  6. Decide whether write tools should be enabled.
  7. Save the grant and copy the generated API key once.
For company/coach OAuth clients, the coach approves the grant during the consent flow started by the AI client.

​
Choose modules

Select only the modules the assistant needs. For example:
  • client lookup: clients
  • booking analysis: clients, bookings, calendar_events
  • invoice review: clients, invoices, subscriptions
  • nutrition check-ins: clients, nutrition_plans, nutrition_logs
Health and private communication modules require extra consent.

​
Enable write tools

Keep grants read-only unless the assistant must create or update data. When write access is needed, enable only the specific write tools required for the workflow. For example:
  • create_client for onboarding flows
  • create_booking for booking flows
  • update_attendance for attendance corrections
  • create_client_note for coach note workflows
  • nutrition plan/log write tools for meal-plan maintenance
The assistant should still ask for confirmation before using write tools. Use the Tools & Modules Registry page for the complete current write-tool list.

​
Handle client MCP requests

Client MCP requests are requests to enable client AI access and client MCP policy permissions for one client in one company. They are not company/coach MCP grants, but the company mcp feature must still be enabled. If a client starts MCP OAuth while client AI access is disabled, FITsociety must not create a grant or issue tokens. The client portal can show a request-access action and notify the assigned coach plus company admins. A coach or admin then reviews the request and enables client AI access from the normal client/company settings when appropriate. Use deduplication or rate limits for request notifications so repeated OAuth attempts do not spam the company.

​
Revoke access

Revoke a grant when:
  • a client integration is no longer used
  • a credential may have been exposed
  • the owning coach leaves the company
  • write access was granted temporarily
Revocation immediately stops the API key and revokes active OAuth tokens for the grant. Clients revoke client AI grants from the client MCP revocation route, not from the coach settings flow.

​
Check audit logs

Use the MCP audit log to review what the assistant has done. Audit entries show:
  • which grant was used
  • which tool was called
  • when it was called
  • whether it succeeded or failed
  • which argument names were supplied
Argument values are not stored in the MCP audit log.