Restrict CIN MCP Tools

Limit which CIN MCP tools your users can use, in each AI client. The examples allow only three Agent Builder tools: agent_builder_list_agents, agent_builder_get_agent and agent_builder_invoke_agent.

note

This page is general guidance. Anthropic and OpenAI change their products often; refer to the official provider documentation for the most up-to-date instructions.

Prerequisites

CIN MCP is connected in your AI client (see Tutorials).
Administrator access to that client: a Claude organization Owner, Claude Code managed settings, or Codex managed configuration.

Tutorial Overview

Client	Limit individual tools	Different tools per group
Claude desktop app and Cowork	Yes, organization-wide (Team and Enterprise)	Yes, with custom roles (Enterprise)
Claude Code	Yes, with managed permission rules	Only by deploying different managed settings to each device group
OpenAI Codex	Yes in `config.toml`, but users can change it	Server allowlists per group; not tool lists

Hyland roles come first

Client settings decide which tools the assistant may call. Hyland roles decide what a call may do: every call runs with the user's own Hyland roles, in every client. For example, a user with only cin-agent-builder.consumer can list and invoke agents, but calls that create or delete agents are refused. Set the roles first (see Subscription & Roles), then use client settings to narrow the tool list further.

Part 1: Claude desktop app and Cowork

For everyone (Team and Enterprise)

Go to Organization settings → Connectors and open the CIN MCP connector.
Set every tool to Blocked except agent_builder_list_agents, agent_builder_get_agent and agent_builder_invoke_agent.
Set those three to Always allow or Needs approval.

Blocked tools are removed before Claude sees them. Users can narrow these settings (for example, require approval for a tool you allowed) but can't widen them.

Per group (Enterprise)

Organization-wide settings are the ceiling; roles narrow them. Leave every tool any group needs allowed organization-wide, then narrow each group with a custom role:

Go to Organization settings → Roles and create a role, for example CIN Agent Users.
On the role's Connectors tab, set the CIN MCP connector to Custom.
Set the three agent tools to Always allow or Needs approval, and every other tool to Blocked.
Assign the role to the group (from your identity provider or SCIM). Give groups that need more tools a broader role.

A user in several roles gets the most permissive grant. Role changes can take up to 15 minutes.

note

In Claude Code sessions in the desktop app, only Blocked carries over from these settings. To control Claude Code fully, also use Part 2.

Part 2: Claude Code

Add permission rules to your Claude Code managed settings (for example C:\Program Files\ClaudeCode\managed-settings.json, an MDM profile, or Organization settings → Claude Code → Managed settings).

Claude Code checks deny rules first, then ask, then allow, and an allow rule can't make an exception to a deny rule. So allow the three tools, and deny the other tool groups:

{
  "allowManagedPermissionRulesOnly": true,
  "permissions": {
    "allow": [
      "mcp__hyland-cin-mcp__agent_builder_list_agents",
      "mcp__hyland-cin-mcp__agent_builder_get_agent",
      "mcp__hyland-cin-mcp__agent_builder_invoke_agent"
    ],
    "deny": [
      "mcp__*__content_lake_*",
      "mcp__*__enterprise_search",
      "mcp__*__knowledge_discovery_*",
      "mcp__*__trace_*",
      "mcp__*__agent_builder_create_*",
      "mcp__*__agent_builder_delete_*",
      "mcp__*__agent_builder_update_*",
      "mcp__*__agent_builder_patch_agent",
      "mcp__*__agent_builder_register_mcp_server",
      "mcp__*__agent_builder_cancel_run"
    ]
  }
}

mcp__hyland-cin-mcp__… uses the server name from Connect Claude Code. The mcp__*__ prefix in the deny rules matches the tools whatever name a user gives the server.
allowManagedPermissionRulesOnly stops users adding their own allow rules.
Tools that match neither list ask the user before running. To refuse every tool except the three, add a managed PreToolUse hook that rejects other CIN MCP tool names, with "allowManagedHooksOnly": true.

Per group: server-managed settings apply to everyone in the organization. For different rules per group, deploy a different managed-settings.json or MDM profile to each group's devices.

Part 3: OpenAI Codex

List the allowed tools for the server in config.toml:

[mcp_servers.hyland-cin-mcp]
url = "https://cin-mcp.ai.app.hyland.com/mcp"
enabled_tools = ["agent_builder_list_agents", "agent_builder_get_agent", "agent_builder_invoke_agent"]
default_tools_approval_mode = "prompt"

enabled_tools is an allowlist; disabled_tools removes tools after it.

Users can edit config.toml, so distribute it with your device-management tooling. Codex's enforced requirements.toml can allow or block the CIN MCP server but can't enforce the tool list. In the ChatGPT Admin Console (Agent security), you can apply different server allowlists to specific users, groups or roles.

Best Practices

Least privilege in Hyland first. Give users only the product roles they need; client settings then shape the experience.
Approvals for changes. Set tools that change or delete data to Needs approval (Claude) or approval_mode = "prompt" (Codex).
Review after updates. New CIN MCP tools aren't covered by tool-by-tool rules automatically. Check the Tool Reference after updates and adjust.

Summary

Hyland roles limit what each user can do in every client. On top of that, Claude organization and role settings, Claude Code managed permission rules and Codex enabled_tools limit which CIN MCP tools the assistant may call. Only Claude Enterprise roles vary the tool list by group without separate device policies.

Prerequisites​

Tutorial Overview​

Hyland roles come first​

Part 1: Claude desktop app and Cowork​

For everyone (Team and Enterprise)​

Per group (Enterprise)​

Part 2: Claude Code​

Part 3: OpenAI Codex​

Best Practices​

Summary​