> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuro-tech.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable MCP access

> Operator setup for an MCP client

This page is for the person administering the Neuron. A client cannot complete OAuth setup unless the Neuron provides a client registration path and an account with the required permissions.

## 1. Select one endpoint

Start with a single endpoint and read-only access. For example:

```text theme={null}
https://neuron.example.com/MCP/Files
```

Do not use `/MCP`; the Neuron exposes separate MCP servers.

## 2. Create a role

In **Administration → Users and Roles → Roles**, create a role for the client. A read-only Files role can contain:

```text theme={null}
OAUTH.Scope.MCP.Files.Resources.List
OAUTH.Scope.MCP.Files.Resources.Read
OAUTH.Scope.MCP.Files.Tools.Search
```

Assign the role to the account that will authorize the client. Registration alone does not grant access.

## 3. Choose client registration

Use one of these approaches:

* **Pre-provisioned static client ID:** use a deployment-specific client registration that has already been configured and tested with Codex, including its redirect URI.
* **Dynamic client registration (DCR):** enable it only if your deployment has been configured and tested for it. The client registers during `codex mcp login`.

Do not ask developers to obtain and paste access tokens as the normal setup. Their MCP client should perform the OAuth flow and store its own credentials.

<Warning>
  Codex cannot sign in unless the Neuron provides a registered OAuth client or dynamic client registration. If neither is available, the operator must configure OAuth before the developer continues.
</Warning>

## 4. Give the developer a connection profile

Provide these values together:

```text theme={null}
Neuron:       https://neuron.example.com
MCP endpoint: https://neuron.example.com/MCP/Files
Client ID:    <client-id>              # omit only when DCR is enabled
Scopes:       MCP:Files:Resources:List,MCP:Files:Resources:Read,MCP:Files:Tools:Search
Sign-in:      <account or identity instructions>
```

Never include a client secret, access token, or refresh token in the profile.

## 5. Test the granted permissions

After the developer signs in:

1. Confirm a read-only request succeeds.
2. Confirm an ungranted write request is rejected.
3. Check the Neuron event log for the request.

See [MCP permissions](/mcp/authentication-and-authorization) when you need to design a different permission set.