---
title: "MCP Connectors: One Switch per Agent, One per Chat"
slug: "mcp-connectors-catalog-per-agent-per-chat"
date: "2026-11-04"
tag: "Application"
summary: "The agent MCP tab now splits connectors into a curated Featured set and the MCP directory, gives each card one on-or-off switch for the agent, sets whose account a connector signs in with, takes the organization's own OAuth app, and adds a per-chat MCP switch to the chat composer."
author: "ibl.ai Engineering"
repo: "iblai/vibe"
linkedin: |
  Every ibl.ai agent now picks its outside services from a catalog of MCP connectors, one switch per agent, and every user gets a per-chat switch in the chat box.

  The MCP tab splits connectors into Featured, curated by the platform, and Directory: the public MCP directory plus your organization's own connectors. Each card has one switch: on or off for this agent.

  An admin decides whose account the agent signs in with. User: each person signs in with their own account from the chat. Agent: one shared account for everyone who chats with this agent. Organization: one shared account for every agent.

  When a service cannot register an OAuth app by itself, the organization enters its own: client id, secret, scopes and the redirect URI to register, which the dialog shows with a copy button.

  In the chat, the composer's + menu gets an MCP row. Each connector has a switch for this chat only, from the next message. A connector your organization requires shows a lock.

  iblai/vibe v2.20.0 (November 3) documents it end to end; the whole tab is one SDK component in your own Next.js app.

  With ibl.ai you own all the code and the data: the tab ships as source, it runs on your own infrastructure or ours, it is model-agnostic across any LLM, and there is no per-seat pricing.

  #iblai #AgenticAI #EnterpriseAI #AIAgents #MCP
---

**ibl.ai agents now pick their outside services from a catalog of MCP connectors, a curated Featured set plus the public MCP directory, with one switch per agent, a per-connector choice of whose account signs in, the organization's own OAuth app when a service needs one, and a per-chat switch in the composer, all mountable in your own Next.js app, because on ibl.ai you own all the code and the data.**

<a href="/images/updates/mcp-connectors-catalog-per-agent-per-chat-featured.webp" target="_blank" rel="nofollow noopener noreferrer"><img src="/images/updates/mcp-connectors-catalog-per-agent-per-chat-featured.webp" alt="The agent MCP tab on its Featured sub-tab: search, date-range and transport filters, an Add Connector button, and cards for Ahrefs, Asana, Atlassian, Globalping, Intercom, Linear, Neon, PayPal, CoinGecko and DeepWiki, each with a gear and an on-or-off switch, most marked Organization scope." width="1440" height="1185" /></a>

The toolkit's `/iblai-vibe-agent-mcp` skill was rewritten for the SDK's new MCP UI and shipped in [iblai/vibe v2.20.0](https://github.com/iblai/vibe/releases/tag/v2.20.0) on November 3, 2026, one of five toolkit releases between v2.18.1 (November 2) and v2.20.1 (November 3).

The MCP tab itself first shipped in the toolkit in v1.2.0 on May 25, 2026. The backend half of this release, MCP Registry sync, per-tenant OAuth and per-user toggles, is in the [October 30 platform update](/updates/platform-update-2026-10-30).

## What does the ibl.ai MCP tab let an agent use?

The MCP tab lists the outside services, Model Context Protocol servers, that an ibl.ai agent can use in its chats. It has two sub-tabs, shown as soon as the organization has featured connectors, at 12 cards a page with a pager per list.

**Featured** is the platform-curated set. **Directory** is everything else the agent may use: the public MCP directory plus the organization's own connectors.

<a href="/images/updates/mcp-connectors-catalog-per-agent-per-chat-directory.webp" target="_blank" rel="nofollow noopener noreferrer"><img src="/images/updates/mcp-connectors-catalog-per-agent-per-chat-directory.webp" alt="The MCP tab's Directory sub-tab: the first cards, Apify, Github Tools, 0Si.ai Disclosures and 1ClickWebsite, each with a User scope pill, a Streamable HTTP transport chip, a gear and a switch; Github Tools is switched on." width="1440" height="665" /></a>

Every card carries one switch: **On for this agent** or **Off for this agent**. Turning the first connector on also gives the agent the `mcp` tool; turning the last one off removes it again, so nobody has to keep the Tools tab in step.

A scope pill on each sign-in connector says whose account the agent uses, a transport chip on Directory cards says how it connects, and the organization's own connectors carry a trash icon. Featured and directory connectors cannot be edited or deleted by an organization.

## Whose account does an ibl.ai agent sign in with?

<a href="/images/updates/mcp-connectors-catalog-per-agent-per-chat-configure.webp" target="_blank" rel="nofollow noopener noreferrer"><img src="/images/updates/mcp-connectors-catalog-per-agent-per-chat-configure.webp" alt="The Configure MCP Connector dialog for Github Tools: server address https://api.githubcopilot.com/mcp/, Connector Scope set to All Agents, Allow Users to Turn Off switched on, Streamable Http transport, OAuth authentication, Authentication Scope User with the note Each person signs in with their own account from the chat, and Connection showing Connected with a Disconnect button." width="600" height="951" /></a>

The gear opens **Configure**, and its **Authentication Scope** answers that question per connector, with three choices.

The frame shows an organization's own connector, set to User: each engineer's agent reaches GitHub with that engineer's own permissions, not a shared service account.

<table style="width:100%; border-collapse:collapse; margin:1.5rem 0; font-size:0.95rem;">
  <thead>
    <tr style="background:#f5f5f0; border-bottom:2px solid #2175C5;">
      <th style="text-align:left; padding:0.75rem; color:#5f6368;">Authentication Scope</th>
      <th style="text-align:left; padding:0.75rem; color:#5f6368;">Whose account the agent uses</th>
      <th style="text-align:left; padding:0.75rem; color:#5f6368;">Where the sign-in happens</th>
    </tr>
  </thead>
  <tbody>
    <tr style="border-bottom:1px solid #e5e7eb;">
      <td style="padding:0.75rem;"><strong>User</strong></td>
      <td style="padding:0.75rem;">Each person's own account</td>
      <td style="padding:0.75rem;">From the chat, by that person</td>
    </tr>
    <tr style="border-bottom:1px solid #e5e7eb;">
      <td style="padding:0.75rem;"><strong>Agent</strong></td>
      <td style="padding:0.75rem;">One shared account for everyone who chats with this agent</td>
      <td style="padding:0.75rem;">From the MCP tab, by someone who manages the agent</td>
    </tr>
    <tr style="border-bottom:1px solid #e5e7eb;">
      <td style="padding:0.75rem;"><strong>Organization</strong></td>
      <td style="padding:0.75rem;">One shared account for every agent</td>
      <td style="padding:0.75rem;">From the MCP tab, by someone who manages the agent</td>
    </tr>
  </tbody>
</table>

On a featured or directory connector the scope is stored as this agent's override, and the card's pill follows it. Only an organization admin, or the Platform API Token, can change it; the platform answers anyone else with a 403.

Picking Agent or Organization when no shared sign-in exists yet turns the connector off until it is switched on again, which opens that sign-in. Shared sign-ins are never made from the chat.

## What if an MCP service cannot register an OAuth app by itself?

<a href="/images/updates/mcp-connectors-catalog-per-agent-per-chat-app-credentials.webp" target="_blank" rel="nofollow noopener noreferrer"><img src="/images/updates/mcp-connectors-catalog-per-agent-per-chat-app-credentials.webp" alt="The App Credentials section of Configure MCP Connector: a Redirect URI field with a Copy button, a Client ID field, a saved Client Secret reading Saved. Enter a new one to replace it., an Advanced disclosure, Remove Credentials and Update; the redirect address and the client id are blacked out." width="600" height="888" /></a>

Most services let the platform register an OAuth app on the fly, through Dynamic Client Registration with discovery that follows RFC 9728 and RFC 8414, PKCE (S256) and RFC 8707 `resource`; each organization registers its own client.

When a service cannot, publishes no sign-in settings, or the organization already has an app for it, the dialog shows **App Credentials** instead of failing.

It shows the Redirect URI to register with the service, with a copy button, then **Client ID** and **Client Secret**.

**Advanced** holds four settings: the permissions (pre-filled from what was discovered), how the secret is sent (in the request, HTTP Basic, or none), extra sign-in settings, and the authorization and token URLs.

The secret comes back masked after saving. **Remove Credentials** deletes the app, and everyone who signed in through it must sign in again. In the frame above we blacked out the redirect address and the client id.

## Can users switch an MCP connector off in their own chat?

<div style="display:flex; flex-wrap:wrap; gap:1rem; justify-content:center; margin:1.5rem 0;">
<a href="/images/updates/mcp-connectors-catalog-per-agent-per-chat-chat-menu.webp" target="_blank" rel="nofollow noopener noreferrer"><img src="/images/updates/mcp-connectors-catalog-per-agent-per-chat-chat-menu.webp" alt="The chat composer's plus menu: Upload File, Camera, Skills, Memory, and an MCP row with a badge reading 1." width="465" height="405" style="max-width:100%; height:auto;" /></a>
<a href="/images/updates/mcp-connectors-catalog-per-agent-per-chat-chat-panel.webp" target="_blank" rel="nofollow noopener noreferrer"><img src="/images/updates/mcp-connectors-catalog-per-agent-per-chat-chat-panel.webp" alt="The chat's MCP panel under the composer, headed Switches here apply to this chat only, from your next message, with Github Tools switched on." width="842" height="455" style="max-width:100%; height:auto;" /></a>
</div>

Yes, unless the organization requires it.

The chat composer's `+` menu gets an **MCP** row whenever the user is signed in, the chat is not embedded, and the agent has at least one connector on. Its badge counts the connectors that are on for this chat and signed in; in the frame it reads 1, for Github Tools.

The panel lists the agent's connectors with one switch each: **on or off for this chat**, applied from the next message.

A new chat starts with each signed-in connector on. A connector saved with **Allow Users to Turn Off** off shows a lock, "Required by your organization", and its switch cannot move.

For a User-scope connector the person has not signed in to, turning it on opens their own sign-in, and the agent uses it from the next message. We cropped the frames to the menu and the panel.

## Who controls each MCP setting on ibl.ai?

Five settings decide whether and how a connector runs in a conversation, and each sits at a different level, so an organization can make one mandatory while a user trims another for a single chat.

<table style="width:100%; border-collapse:collapse; margin:1.5rem 0; font-size:0.95rem;">
  <thead>
    <tr style="background:#f5f5f0; border-bottom:2px solid #2175C5;">
      <th style="text-align:left; padding:0.75rem; color:#5f6368;">Setting</th>
      <th style="text-align:left; padding:0.75rem; color:#5f6368;">Where</th>
      <th style="text-align:left; padding:0.75rem; color:#5f6368;">Who it affects</th>
    </tr>
  </thead>
  <tbody>
    <tr style="border-bottom:1px solid #e5e7eb;">
      <td style="padding:0.75rem;"><strong>Connector Scope</strong></td>
      <td style="padding:0.75rem;">Add / Configure</td>
      <td style="padding:0.75rem;">Which agents may list it: all agents or this one</td>
    </tr>
    <tr style="border-bottom:1px solid #e5e7eb;">
      <td style="padding:0.75rem;"><strong>On / Off for this agent</strong></td>
      <td style="padding:0.75rem;">The card</td>
      <td style="padding:0.75rem;">This agent's chats</td>
    </tr>
    <tr style="border-bottom:1px solid #e5e7eb;">
      <td style="padding:0.75rem;"><strong>Authentication Scope</strong></td>
      <td style="padding:0.75rem;">Configure</td>
      <td style="padding:0.75rem;">Whose account the agent signs in with</td>
    </tr>
    <tr style="border-bottom:1px solid #e5e7eb;">
      <td style="padding:0.75rem;"><strong>Allow Users to Turn Off</strong></td>
      <td style="padding:0.75rem;">Add / Configure</td>
      <td style="padding:0.75rem;">Whether the chat's switch can move</td>
    </tr>
    <tr style="background:#f0f9ff; border-bottom:1px solid #e5e7eb;">
      <td style="padding:0.75rem;"><strong>On / Off for this chat</strong></td>
      <td style="padding:0.75rem;">The chat's MCP panel</td>
      <td style="padding:0.75rem;">One conversation of one user</td>
    </tr>
  </tbody>
</table>

Only the organization that owns a connector can make it mandatory, so Allow Users to Turn Off cannot be changed on a featured or directory connector. A connector the organization has switched off over the API is never used, whatever the agent or the user chose.

With role-based access control on, the chat's MCP row needs read access to the agent's `mcp_servers` field, and the seeded chat role does not have it until it is granted.

## How do you add the MCP tab to your own app?

The tab is one component, `McpTab`, imported from `@iblai/iblai-js/web-containers/next` and mounted on a page under the shared `AgentSettingsProvider`; it takes no required props. The chat's panel is exported on its own as `McpServersMenu` for a custom composer.

Two more pieces come with it: two lines registering `mcpApiSlice` in the store, and a sign-in return page at `/google-oauth-callback/`. It needs `@iblai/iblai-js` 2.62.1 or later; the new controls arrived in `@iblai/web-containers` 1.58.1.

The skill also lists 20 data-layer hooks for a custom UI and the REST calls behind every control. Read it at [MCP tab for your app](/developer/skills/iblai-vibe-agent-mcp), or install the skills into your coding agent and let it do the wiring; see [Agentic Vibe](/product/agentic-vibe).

## Why does it matter that you own the MCP layer?

MCP connectors are where an agent reaches your Jira, your support desk and your database, so whoever runs that layer holds the keys to them.

On ibl.ai the tab ships as source in the SDK, the platform behind it comes as source under ibl.ai's Full Code License, and the OAuth apps can be your organization's own, so the credentials and the connector choices stay on infrastructure you control.

The same code runs on our hosted cloud or your servers, including air-gapped networks, each agent runs the model you chose for it, and there is no per-seat pricing. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University.

## Want to see your agents use your own tools?

We will switch on a connector for one of your agents, sign it in with the scope you pick, and run a chat against it, in a 30-minute call. [Book a 30-minute demo](https://cal.com/iblai/30min) or [talk to the ibl.ai team](/contact) — ibl.ai is family-owned and operated from New York, NY.