Access control

Tool access is enforced at two levels: by access control role and by development package. Both checks run on every tool call. The MCP server cannot grant a user wider access than the Cockpit would.

Role check

Every tool runs a role check before it dispatches the action. If your user account does not have the role listed for a tool group, the tool fails with an access denied error and no action is performed.

Tool group Required role Operations Reference

Applications

appdesigner

List, get, save, delete

Applications tools

Web apps

webapp

List, get, save, delete

Web app tools

Server scripts

scripteditor

List, get, save, delete

Server script tools

Adaptive entities

adaptivedesigner

List, get, save, delete

Adaptive entity tools

Tables

tabledefinition

List, get, save, delete

Table tools

APIs

apidesigner

List, get (read-only)

API tools

Development packages

package

List, get, save, delete

Package tools

To grant or revoke a role, an administrator must update the user account in the Neptune DXP - Open Edition user management interface. See User roles and permissions.

Development package check

For non-administrative users, tools that list or modify artifacts also run under the user’s development package permissions. You see and can change only the artifacts in packages that your roles grant access to.

Save and delete operations additionally run the platform’s standard before-save hooks, edit-lock checks, and package-edit-permission checks. An MCP client has no way to bypass these checks.

Related topics