[Enhancement]: ACL Permissions with MCP Servers

[chesaman12]

What features would you like to see added?

With the new ACL based permission system, I would like a way to permission not only agents but also MCP Servers. Some MCP servers may only be useful to certain people or departments in a company. It would be a nice edition to be able to hide and restriction MCP server access via user / user group picker like agents.

More details

MCP Servers are visible to everyone as global access through yml files that are used on startup. Removing and adding MCP Servers can only be done via manipulating config files and then restarting the instance. These are always global changes that effect all users. It would be really nice to be able to restrict certain users / user groups like you can with agents so that admins can restrict what MCP Servers different users or groups can see.

Which components are impacted by your request?

UI, General

Pictures

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

Some non-global settings are planned via setting configs for different roles/groups of users:

#3137 (comment)

[danny-avila]

MCP Servers specifically will likely see ACL treatment at the point where they can be added from the UI, from which they can be shared to specific users/groups/roles permissions permitting.

The "default directory" would also allowed to be separated but at the config level, with different users based on role and possibly group receiving different configs.

[chesaman12]

Do you think it will be possible to also restrict what users could add servers into the UI? Something like admins can only add them so all users aren't able to add anything, even if it is just scoped to that user?