AI access — connect your own AI assistant

AI access lets an AI assistant you already use — Claude Code, Claude Desktop, Cursor, or anything else that speaks the Model Context Protocol — work directly with your MFICore sites. It can look at your data, read and draft your pages, and run your workflows, all by asking in plain language.

This is different from the AI Agent built into your dashboard. The AI Agent lives here and answers questions; AI access lets an assistant that lives somewhere else reach in and do things.

Find it under Account → AI access, or on a single site under Identity → AI access.

The one rule worth knowing

A connection acts as you. It can never see or change anything you could not see or change yourself. If you have read-only access to a site, so does it. If someone removes your access, the connection loses it at the same moment.

That is the whole security model, and everything below is about narrowing it further.

Connecting an assistant

Copy the URL at the top of the panel into your assistant — no token, no password, nothing to keep secret. Pick your client (Claude Code, Claude Desktop, or something else) and the instructions change to match: for Claude Code it is one line to run in your terminal; for Claude Desktop you open Settings → Connectors → Add custom connector and paste the URL there.

A remote connection like this one does not go in Claude Desktop's claude_desktop_config.json. That file is only for assistants Claude runs on your own machine, and it will report a remote server pasted into it as an invalid configuration.

The first time the assistant tries to do anything, MFICore opens a browser window and asks you to approve it. That screen is the one that matters, so it is worth reading rather than clicking through:

• The name is what the app calls itself. Nothing verifies it. Underneath it we show the address the app will be sent back to — that part cannot be faked. If it is not an address you expect, cancel.
• "Also let it change things" starts unticked. Leave it off and the assistant can read everything you can and change nothing. Tick it and it can publish pages, write data, run workflows and send messages.
• Which sites — all of yours by default, and you can narrow it to one.

Approve it, and the assistant is connected. It appears in your list below, marked App, and you can revoke it there at any time. If it later needs permission to change things it will ask again, and you will see a screen that says so and names what it already has.

If you cancel, nothing is shared. It is safe to ignore an app that keeps asking.

Creating a token instead (headless, CI, scripts)

Some things have no browser to approve anything in — a build agent, a server, a script on a schedule. For those, choose Mint a token: you get a secret the client sends as a header, rather than a sign-in.

A token is the older and slightly riskier path, because the secret sits in a file somewhere. Prefer the URL above where you can.

Give it a name you will recognise later — "Claude Code on my laptop" is more useful than "token 1" when you come back in six months and find two of them.

Three choices matter:

• Allow it to change things. Off by default, and worth leaving off until you need it. With it off the assistant can read everything you can, and change nothing. With it on it can publish pages, write data, run workflows and send messages.
• Monthly spending limit. Some things an assistant does cost money — running a workflow, querying a datastore. Set a limit and it simply stops doing billable work when it gets there. You will be told when it is close, and again when it stops.
• Expires after. A connection that never expires is one nobody ever revisits. Setting a number of days is a good habit.

If you have two-factor authentication turned on, you will be asked for a code. This is deliberate: a connection lasts a long time, so creating one needs the same proof as signing in.

When the token is created you are shown it once, with a ready-made snippet. This is the only time the token is shown. Copy it now; if you lose it, revoke the connection and make a new one.

A brand-new token can take a few seconds to start working everywhere. If your assistant says it is invalid straight away, wait a moment and try again.

Checking it works

Each connection has a Test button. It answers immediately, right there in the page, with either a confirmation and the number of tools available, or the reason it is not working. Use it before you go hunting for a problem in your assistant's settings.

Seeing what it has been doing

Recent activity shows what your assistants have actually done: which tool, when, and whether it worked. Refusals are shown too, and they are the useful ones — an assistant repeatedly being told no usually means it is confused about something, or reaching for access it does not have.

This is a recent window rather than a permanent record. What you were charged for is in Billing.

Limiting a connection to one site

From a site's own Identity → AI access page you get that site's endpoint. An assistant connected there reaches only that site, which makes it safe to hand to a collaborator who should not see everything else you own.

Your connections list

Every connection shows as either an App — one that connected itself and that you approved in a browser — or a Token you minted and pasted somewhere. The difference matters when something goes wrong: only a token is a secret that can be copied out of a file.

Revoking

Revoke stops a connection working immediately, everywhere. Do it if you lose a token, stop using an assistant, or see something in the activity list you do not recognise.

Revoking an App also ends its sign-in, so it has to ask your permission again from scratch — it cannot quietly carry on.

Two other things also stop every connection at once, which is usually what you want if you think your account itself is compromised: changing your password, and Sign out everywhere on the Security page.

What can it actually do?

The panel lists every tool a connection can use, with a plain-English description of each and a badge on the ones that change things. The list comes from the server, so it is always what your cluster really offers rather than what the documentation happened to say.

Tools that only read are unbadged. Tools that change something are marked, and the ones that are hard to undo — publishing a page, running a workflow, sending a message — are marked more strongly. A good assistant will ask you before using those.