What can the agent reach before I grant anything?

Only your own tracked Attensira data. A granted plugin is the only way a third-party tool enters the agent's toolset, and until you grant one the agent cannot see those tools at all.

Can I connect my own MCP server?

Yes. Register it with a name and a URL, choose auth none or apiKey, and Attensira calls tools/list and registers what it finds. Discovered tools are namespaced mcp__ __ , so they cannot collide with each other or shadow Attensira's built-in tools.

Why is OAuth not supported for my server?

Because Attensira has no token store and cannot hold or refresh an OAuth credential for you. Rather than accept the configuration and fail later with an undiagnosable 401, registering an OAuth server returns an explicit error. Use apiKey, or put an authenticating proxy in front of the server.

What happens if my server goes down?

It does not silently disappear. It becomes a single tool named mcp__ __unavailable that explains the problem when called, so the agent reports a real diagnosis instead of confidently claiming it never had the capability.

Is a grant per person or per workspace?

Per workspace. Everyone in that workspace sees the same toolset, and you can revoke the grant at any time. There is no per-chat or per-user grant.

Is this the same as the Attensira MCP server?

No — they point in opposite directions. Plugins and registered servers are inbound: tools the Attensira agent can call. Attensira's MCP server is outbound: it lets your assistant call Attensira. They share no configuration and no credentials.

Plugins

A granted plugin is the only way a tool reaches the agent

Plugins give the agent reach beyond Attensira's own data — and they are the boundary of what it can do. Grants are per workspace and revocable, and until you grant one the agent cannot see those tools at all. You can also register your own MCP server and have every tool on it become callable.

Get Started Book A Demo

Nothing by default
Until a plugin is granted, the agent cannot see its tools at all.
Per workspace, revocable
A grant applies to the whole workspace and you can withdraw it at any time.
Bring your own MCP server
Register a name and URL; we call tools/list and register what we find.
Namespaced, never shadowing
Discovered tools are mcp__<slug>__<tool>, so built-ins cannot be overridden.

By Karl-Gustav KallasmaaLast updated September 3, 2026Behaviour on this page is checked against docs.attensira.com

The sentence that defines the boundary

A granted plugin is the only way a tool enters the agent's toolset. That is the whole security model in one line, and it runs the other way from how most AI products are sold: the default is not a broad set of capabilities you can narrow, it is nothing at all.

You open Plugins, pick one, and grant it. The grant is per workspace and you can revoke it whenever you like. Before that point the agent does not have a disabled version of the tool — it cannot see it, so it cannot try to use it, and it cannot tell you it will do something it is not able to do.

The catalog is shelved by state, so what is available now is distinguishable from what is coming. A plugin listed but not yet connectable says so rather than failing when you try to use it.

Register your own MCP server

If you run an MCP server, register it and the agent can call it like any built-in tool. That is a stronger position than an integrations list, because it does not require us to have anticipated your stack: whatever your team already exposes to its own assistants, the Attensira agent can use.

Give the server a name and a URL. The name becomes the slug the agent uses to address it. Choose an auth mode — none for an open server, or apiKey for a key we send on each request. Attensira then calls tools/list on the server and registers what it finds.

Discovered tools are namespaced as mcp__<slug>__<tool>, so a search tool on a server registered as warehouse becomes mcp__warehouse__search. The namespace makes collisions impossible: two servers can both expose search, and Attensira's own built-in tools can never be shadowed by a registered one, because the built-ins are assembled first.

What is refused, and why refusing early is the right call

OAuth is not supported as an auth mode. Attensira has no token store, so it cannot hold or refresh an OAuth credential on your behalf. Registering a server with OAuth returns an explicit error rather than accepting the configuration and failing later with a 401 nobody can diagnose. Use apiKey instead, or put an authenticating proxy in front of the server.

An unreachable server does not silently vanish from the toolset either. It becomes a single tool named mcp__<slug>__unavailable that explains the problem when called. A tool that disappears looks to the agent like a capability that never existed, and it will then confidently tell you it cannot do something it normally can. A tool that answers “this server is unreachable” gets you a real diagnosis instead.

Bound	Applies to
Discovery timeout	Listing tools when a server is added, or when a session starts
Call timeout	A single tool call
Tools per server	How many discovered tools are registered
Discovery budget	Total time spent discovering across all servers before a session starts

Inbound and outbound are opposite directions

Two things in this product involve MCP and they point opposite ways, so it is worth being precise.

Plugins and registered MCP servers are inbound to the agent: tools the Attensira agent can call. Attensira's own MCP server is outbound to you: it lets your assistant call Attensira, read your workspace and change it.

You can use either, or both. They share no configuration and no credentials — a plugin's API key has nothing to do with your Attensira API key, and neither one grants the other anything.

How a grant behaves once it is live

A grant is workspace-wide, not per person and not per chat. Everyone working in that workspace gets the same toolset, which is the right default for a shared measurement surface and worth knowing before you grant something sensitive.

When a grant is revoked, or a permission is missing, the failure shows up as evidence rather than as a shrug. A tool call that actually failed for that reason raises a missing-connection row in your Inbox — raised from the failed call, never from the agent's opinion about what it can do.

Registering an internal server

A team that already runs an MCP server in front of its content warehouse can hand it to the agent in three fields.

Name: warehouse

URL: https://mcp.internal.example.com/mcp

Auth: apiKey

Discovery calls tools/list and registers what it finds:

mcp__warehouse__search

mcp__warehouse__get_document

If the server is down, the agent sees exactly one tool instead:

mcp__warehouse__unavailable

The agent can now use your search inside a chat or an automation, cannot shadow anything Attensira ships, and — if your server goes down — tells you why rather than quietly forgetting the capability existed.

What it does not do

Plugins are deliberately constrained. Most of the limits below exist so a failure has a diagnosis.

Plugins cannot be re-read on demand. There is no force-refresh control, because there is no endpoint behind one — a button that spins and does nothing is worse than no button.
They cannot authenticate with OAuth. Registering an OAuth server errors immediately rather than failing later.
A granted plugin is available to the whole workspace, not to one person or one chat.
Discovery and calls are bounded by timeouts, a tools-per-server cap and a whole-session discovery budget. A server that exceeds the discovery budget is skipped for that session rather than delaying your answer.
A registered MCP server is not the same thing as Attensira's MCP server, and one does not authenticate the other.

Which plans include it

Included on every plan — Starter $129/mo, Growth $349/mo, Business $699/mo.

Plugins are not gated by plan in the documentation. What a plugin costs you is the agent work it enables: a chat or automation run that calls a tool is still metered agent work.

Plan facts on this page are read from the same ladder that prices /pricing, so they cannot drift from what you are actually charged.

Read further

Documentation

Plugins — grants, registering your own MCP server, and what is refused

Documentation

Attensira's MCP server — the outbound direction, for your own assistant

The agent

The toolset a grant adds to, and the rules it works under.

Inbox

A revoked grant or a missing permission surfaces here, raised from a real failure.

Automations

Granted tools are available to scheduled runs, not just to chats.

Credits

Granting is free. The agent work that uses the tool is metered.

FAQ

Questions people actually ask

Answers here match the product documentation. Where the product cannot do something, this says so.

Still deciding? Compare plans or talk to us.

A granted plugin is the only way a tool reaches the agent

Nothing by default

Per workspace, revocable

Bring your own MCP server

Namespaced, never shadowing

The sentence that defines the boundary

Register your own MCP server

What is refused, and why refusing early is the right call

Inbound and outbound are opposite directions

How a grant behaves once it is live

Registering an internal server

What it does not do

Which plans include it

Read further

Questions people actually ask

What can the agent reach before I grant anything?

Can I connect my own MCP server?

Why is OAuth not supported for my server?

What happens if my server goes down?

Is a grant per person or per workspace?

Is this the same as the Attensira MCP server?

The sentence that defines the boundary

Register your own MCP server

What is refused, and why refusing early is the right call

Inbound and outbound are opposite directions

How a grant behaves once it is live

Registering an internal server

What it does not do

Which plans include it

Read further

Questions people actually ask

What can the agent reach before I grant anything?

Can I connect my own MCP server?

Why is OAuth not supported for my server?

What happens if my server goes down?

Is a grant per person or per workspace?

Is this the same as the Attensira MCP server?