Skip to docs content
Browse documentation
On this page

Lock an MCP server to a package

A connected MCP server exposes every approved tool to execute and every package. Lock the server to saved packages, and put the calls you want in a thin wrapper package.

A connected MCP server is a live connector. Every approved tool becomes minion.mcp["server-name"].tool_name(...) for execute and every package. That is often wider than the job. Lock the server to saved packages so ad hoc execute can no longer call it, then put only the calls you want in a thin wrapper package.

OAuth tokens and bearer tokens stay as wide as the server issued them. The server lock holds who may call the connector.

What the lock does

Usage on the server (on the MCP servers page ):

  • Execute and packages (default): execute and every saved package can call minion.mcp["name"].
  • Saved packages only: only saved packages (exports, jobs, event handlers, webhooks and package apps) can call it. Ad hoc execute is refused.

Tokens stay in Minion's encrypted store and never enter the sandbox. Disabling a server still stops everyone from calling it; the lock leaves the connection up and narrows who may use it.

minion.mcp.lock({ name }) switches the server to saved packages only. The lock applies to all saved packages in the organization, not to a single package. Unlocking is web-only, on the MCP servers page. Locking and unlocking both need an owner or admin.

The loop

  1. Connect the server. Follow Connect remote MCP servers (minion.mcp.add, authorize if needed, approve the tools). Confirm tools with minion.mcp.list().
  2. Name the grant. "This package may call these tools. Execute may not." Write that in the package README.
  3. Save a thin wrapper package. Follow package authoring . Give it its own name. The export calls minion.mcp["server-name"] for the allowed tools only. Do not re-export the whole server.
  4. Publish, then lock. After the first successful publish, call minion.mcp.lock({ name }). Say so in chat so the owner knows unlocking is a click on the MCP servers page.
  5. Smoke-test from the package, not execute. Invoke the named export. A later execute that calls minion.mcp["server-name"] should be refused.

Because the lock covers every saved package, other packages in the organization can still call the server. Pin the wrapper to a known good version with minion.packages.update({ name, changes: { pinnedVersion } }) if you want later saves to wait for a deliberate publish.

When to use this guide

Use it when someone wants a connected MCP server that execute must not call, or when a home or third-party MCP server is coarser than the intended package. For connecting the server, see Connect remote MCP servers and, for home LAN servers, Connect a home MCP server .