Control MCP client access

In development mode, every MCP client connected to the gateway can access all registered servers. In enterprise mode, that is no longer true. No MCP client can access any registered server until you create a client identity and give it an allow-list.

Create an MCP client

Use create mcp-client and specify the servers it should be allowed to access:

mcpjungle create mcp-client cursor-local --allow "calculator, github"

Mcpjungle prints the generated access token once:

MCP client 'cursor-local' created successfully!
Servers accessible: calculator,github

Access token: 1YHf2LwE1LXtp5lW_vM-gmdYHlPHdqwnILitBhXE4Aw
Send this token in the `Authorization: Bearer {token}` HTTP header.

If you omit --allow, the client is created but cannot access any registered servers.

You can use --allow "*" to give an MCP client access to all registered MCP servers.

mcpjungle create mcp-client cursor-local --allow "*"

This is highly discouraged in production environments. Prefer explicit allow-lists so each client only gets access to the servers it actually needs.

Use the token from an MCP client

Your MCP client or bridge must send the token in the Authorization header. Example for Cursor:

{
  "mcpServers": {
    "mcpjungle": {
      "url": "http://localhost:8080/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_ACCESS_TOKEN"
      }
    }
  }
}

Example for Claude via mcp-remote:

{
  "mcpServers": {
    "mcpjungle": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "http://localhost:8080/mcp",
        "--allow-http",
        "--header",
        "Authorization: Bearer YOUR_ACCESS_TOKEN"
      ]
    }
  }
}

Custom access tokens

If you want to supply your own token instead of using a generated one:

mcpjungle create mcp-client cursor-local --allow "calculator, github" --access-token my_custom_token

This is useful when tokens are issued or tracked externally. For example, you might be managing identities and tokens through Vault or AWS KMS.

Create a client from a config file

{
  "name": "cursor-local",
  "allowed_servers": ["calculator", "github"],
  "access_token": "my_secret_token_123",
  "access_token_ref": {
    "file": "/path/to/token-file.txt",
    "env": "ENV_VAR_NAME"
  }
}

Create it with:

mcpjungle create mcp-client --conf ./cursor-local.json

When creating an MCP client from a config file, you must provide a token explicitly. Mcpjungle cannot print an auto-generated token back through the file-based workflow.

See the configuration file reference for the supported ways to supply a custom token in config files.

Recommended pattern

For shared environments, create one MCP client per integration or workflow, not one shared token for everything. Examples:

one client for Cursor
one for Claude Desktop via mcp-remote
one for Copilot
one per internal agent or service

That keeps access explicit and rotation manageable.

Governance overview

Understand how enterprise mode changes the operating model.

Clients and users

Manage machine identities and human user accounts separately.

Production deployment

Run Mcpjungle in enterprise mode and initialize it correctly.

Integrations

See how to apply client tokens in Cursor, Claude, and Copilot configs.

Get Started

Servers and Tools

Integrations

Deploy and Operate

Access and Governance

Limitations

Developers

Control MCP client access

Create an MCP client

Use the token from an MCP client

Custom access tokens

Create a client from a config file

Recommended pattern

Governance overview

Clients and users

Production deployment

Integrations

​Create an MCP client

​Use the token from an MCP client

​Custom access tokens

​Create a client from a config file

​Recommended pattern

​Related pages

Governance overview

Clients and users

Production deployment

Integrations

Create an MCP client

Use the token from an MCP client

Custom access tokens

Create a client from a config file

Recommended pattern

Related pages