> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tess.im/llms.txt
> Use this file to discover all available pages before exploring further.

# Sharing and permissions

> How personal and workspace-shared Custom MCP servers work, including per-user opt-in and governance.

Custom MCP servers start **personal**. Sharing one with the workspace is a separate, explicit action. Other members never inherit your connection automatically.

This page covers the ownership model shipped with Tess Custom MCP (personal vs shared, per-user opt-in, and governance). For how to add a server, see [Custom MCP](/en/mcp-custom). For the hosted Tess endpoint, see [MCP Server](/en/api-mcp).

## Personal vs shared

|                             | Personal                              | Shared                                     |
| --------------------------- | ------------------------------------- | ------------------------------------------ |
| **Who can use it**          | Only the creator, until they share it | Workspace members who **opt in**           |
| **Default for new servers** | Yes                                   | No — sharing is a separate step            |
| **OAuth token**             | Always the creator's account          | Each member connects **their own** account |
| **Static token / API key**  | Stored for the creator                | Workspace credential set by a governor     |

<Warning>
  Do not share a server bound to a personal identity (WhatsApp, personal email, personal CRM). Anyone who opts in can call those tools. Keep that server personal.
</Warning>

## Opt-in (default off)

When a governor shares an MCP, it does **not** appear in other members' chat until each person opts in (MCP Plugins or the Connectors modal). Preferences are per user and default to off.

Tool chips are also per user: turning a capability off for you never changes a teammate's selection.

## Who can do what

* **Create a personal MCP** — members with permission to add Custom MCP servers.
* **Share, unshare, or set a workspace static credential** — governance permission (`mcp:plugins:manage` / workspace MCP governance).
* **Delete a shared MCP** — governance.
* **Connect OAuth** — every user who wants to use that server, including on a shared MCP.

<Info>
  Tess never reuses someone else's OAuth token. If a shared OAuth MCP has no connected token for you, Tess hides it from tool discovery instead of calling it unauthenticated.
</Info>

## Fail-closed credentials

If Tess has no usable credential for you (expired OAuth, missing static token, failed connection), the server is treated as disconnected. It is not injected into the agent with empty auth.

## Related

* [Custom MCP](/en/mcp-custom) — add and connect a server
* [MCP best practices](/en/mcp-best-practices)