> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fitsociety.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Setup for Coaches

> How a Manager or Admin coach configures FITsociety MCP access.

This guide explains the operational setup for coaches and company admins who
control company/coach MCP access.

Client MCP access is different: it is approved by the client in the client
portal OAuth flow, requires the company `mcp` feature, requires client AI access
to be enabled for that client-company relationship, and is limited by the
company client MCP policy to explicit `client_ai_*` modules. See
[Client AI Access](/mcp/client-ai-access) for that surface.

## Prerequisites

The coach creating or approving the grant must:

* have active access to the company
* hold a `Manager` or `Admin` role
* have access to the MCP settings in the coach dashboard

The company must also have the `mcp` feature enabled. If the feature is not
enabled, MCP requests fail with `COMPANY_MCP_FEATURE_DISABLED`.

## Enable the MCP feature

MCP must be enabled for the company before grants can be used. Depending on the
deployment, this may be controlled by FITsociety support, an internal admin
panel, or company feature settings.

If you see `COMPANY_MCP_FEATURE_DISABLED`, ask the workspace or FITsociety admin
to enable MCP for the company.

## Create a grant

A grant defines what an AI client can access.

For a static company MCP API key:

1. Open the company MCP settings.
2. Create a new MCP grant.
3. Give the grant a clear name, such as `Claude - read-only client review`.
4. Choose an expiry period.
5. Select allowed modules.
6. Decide whether write tools should be enabled.
7. Save the grant and copy the generated API key once.

For company/coach OAuth clients, the coach approves the grant during the
consent flow started by the AI client.

## Choose modules

Select only the modules the assistant needs. For example:

* client lookup: `clients`
* booking analysis: `clients`, `bookings`, `calendar_events`
* invoice review: `clients`, `invoices`, `subscriptions`
* nutrition check-ins: `clients`, `nutrition_plans`, `nutrition_logs`

Health and private communication modules require extra consent.

## Enable write tools

Keep grants read-only unless the assistant must create or update data.

When write access is needed, enable only the specific write tools required for
the workflow. For example:

* `create_client` for onboarding flows
* `create_booking` for booking flows
* `update_attendance` for attendance corrections
* `create_client_note` for coach note workflows
* nutrition plan/log write tools for meal-plan maintenance

The assistant should still ask for confirmation before using write tools.
Use the [Tools & Modules Registry](/mcp/tools) page for the complete current
write-tool list.

## Handle client MCP requests

Client MCP requests are requests to enable client AI access and client MCP
policy permissions for one client in one company. They are not company/coach MCP
grants, but the company `mcp` feature must still be enabled.

If a client starts MCP OAuth while client AI access is disabled, FITsociety must
not create a grant or issue tokens. The client portal can show a request-access
action and notify the assigned coach plus company admins. A coach or admin then
reviews the request and enables client AI access from the normal client/company
settings when appropriate.

Use deduplication or rate limits for request notifications so repeated OAuth
attempts do not spam the company.

## Revoke access

Revoke a grant when:

* a client integration is no longer used
* a credential may have been exposed
* the owning coach leaves the company
* write access was granted temporarily

Revocation immediately stops the API key and revokes active OAuth tokens for the
grant.

Clients revoke client AI grants from the client MCP revocation route, not from
the coach settings flow.

## Check audit logs

Use the MCP audit log to review what the assistant has done. Audit entries show:

* which grant was used
* which tool was called
* when it was called
* whether it succeeded or failed
* which argument names were supplied

Argument values are not stored in the MCP audit log.