Posit Connect MCP

Connect includes a built-in Model Context Protocol (MCP) server for managing content. The MCP reference lists the name, description, behavior, inputs, and outputs for each built-in tool. For client setup instructions, see Connect MCP in the user guide.

Configure the built-in server

Set ConnectMCP.Enabled to false to disable the built-in server. Set ConnectMCP.MCPBundleEnabled to false to stop serving the MCP bundle at /mcpb while the server stays enabled. For the setting descriptions, see the ConnectMCP section of the configuration appendix.

To keep the server enabled while excluding tools, add one ConnectMCP.BlockedTool entry for each exact tool name in the reference. Connect logs a warning for each unregistered tool name and continues startup.

/etc/rstudio-connect/rstudio-connect.gcfg
[ConnectMCP]
Enabled = true
BlockedTool = "publish_static_content"
BlockedTool = "deploy_bundle"

This example removes the two named tools from the available tool list.

Security considerations

Connect limits what an agent can do through the built-in server:

  • Each tool call runs with the permissions of the Connect user who authenticated the client. An agent cannot do more than that user can do.
  • Each tool has MCP tool annotations that tell the client whether the tool changes server state. Read-only tools set readOnlyHint. Connect writes a connect_mcp_tool_call audit event for each tool call that changes state. The event records whether the call completed or failed. Connect does not audit read-only tool calls. The deploy_bundle and publish_static_content tools set destructiveHint because they can replace the active bundle of existing content. The MCP reference shows the behavior of each tool.
  • Administrators can use ConnectMCP.BlockedTool to remove tools that the organization does not need.

Connect does not ask the user to confirm a tool call. The MCP client is responsible for confirmation and uses the annotations to decide when to ask. To use these protections:

  • Configure MCP clients to ask for user approval before they call tools that change server state.
  • Block tools that your organization does not need.
  • Give each user only the content access and user role that their work needs.

Prompt injection

These protections limit the effect of prompt injection. Tools return text that other users can write, such as content titles, descriptions, pin metadata, source files, and deployment logs. That text can contain instructions for the agent. An agent that follows these instructions can create, publish, or deploy content with the permissions of the user. The agent can also download source archives and pin data that the user can access, and send that data to other services. Connect cannot detect these instructions, so client approval and limited permissions are the main protections.