Disconnect an AI agent

• MCP
• AI
• Account
• Privacy
• Alerts

When we launched the MCP server, we said there was no way to take back access from a connected agent, and that a screen for it was next. It is here. Open Settings, then AI agents, and every agent you approved is listed with a Disconnect button beside it.

Every agent you approved, in one place#

Each row shows the agent's name, whether we could verify where it comes from, the permissions you gave it, and when it last called. An agent you approved but never used says so, rather than showing a date that would mean nothing.

A grant belongs to your account, not to the workspace you were looking at when you approved it. So an agent on this list reaches every workspace you belong to, and the page says so where you cannot miss it.

Disconnecting takes effect on its next request#

An agent's token is not something we can reach into and cancel, so we refuse it instead. From the moment you disconnect, any token issued before that moment is turned away, with a message telling the agent to ask you again rather than reporting a dead server. The approval it held is deleted too, so it cannot slip back in without a person clicking approve.

This covers your account only. Anyone else on your team who connected the same app keeps their own access. One application shares one client id across every customer using it, and cutting that off would have disconnected all of them.

One gap remains, and you should know about it. If an agent obtained an approval code just before you clicked Disconnect and exchanged it just after, that token is newer than the disconnect and gets in. Clients exchange a code immediately, so the window is under a second, and the agent appears on the list again where you can disconnect it once more.

Signing out of Parahuman still does not disconnect an agent. Use the button.

Agents can now ask to edit keywords and draft replies#

The server told clients about the three read permissions and nothing else. Every client builds its request from that list, so keyword editing and reply drafting were never requested, never granted, and five of the eleven tools could not be called by any client.

The server now advertises every permission, because every one of them has a tool behind it. The consent screen lists them all, reads and writes together, and you approve what the agent asked for or decline it. The rule is that a permission reaches that screen only once a tool consumes it, so you are never asked to approve something that does nothing.

Reply drafting still never posts anywhere. It saves a draft for you to send from Parahuman.

Alerts on your saved views, from an agent#

The one permission that granted nothing now carries five tools. An agent can list the saved views of a workspace with the filters each one applies, rename a view, list the alerts with every destination they send to, create the alert for a view, and update an alert: rename it, switch it off without deleting it, or change who receives it and how often.

What it cannot do is as deliberate as what it can. There is no tool to create a view or change which mentions one collects, because a view with no filters paired with an alert would send you every mention we find. A view carries one alert, so asking for a second one is refused with a message that says why.

One caveat the tool states in its own description, and so do we. A webhook destination is stored but not delivered. Only email and Slack are sent today.

The consent screen names this permission for what it is, renaming views and managing their alerts, rather than the creating and editing it promised before.

Set it up without leaving the app#

The AI agents page carries the server address and the setup steps for Claude Code, Claude Desktop and Cursor, each with a copy button, plus the bare address for any other client that speaks streamable HTTP and OAuth. It also lists every permission an agent can be granted, marked read only or can change, so you know what you are agreeing to before an agent asks.