# AI agents (MCP)

> Let members connect their own AI agent, such as Claude Code, Claude Desktop, claude.ai or Cursor, to manage their team's tickets in By Dawn, and turn it on for your organization.

This page shows you how to connect the AI agent you already use, such as Claude Code, Claude Desktop, claude.ai or
Cursor, to By Dawn. Once it's connected you can ask it about your team's work ("What's open for me this cycle?") and have
it make changes for you ("Assign SAW-123 to Dana and move it to Review"). If you're an owner or admin, it also shows
you how to turn this on for your organization and decide what agents may do.

The agent acts as you. It sees the projects and tickets you can see, and changes only what you could change yourself,
within the permissions you give it when you connect. Everything it does shows you as the author, "via MCP" and the
client's name, on the ticket's timeline.

## Before you start

- An owner or admin has to turn AI agents on for your organization first. Until then you can't connect. See [Turn it
  on for your organization](#turn-it-on-for-your-organization).
- Your AI client must support MCP servers you add yourself (often called custom connectors or remote MCP servers).
  Claude Code, Claude Desktop, claude.ai and Cursor all do.
- Organizations that require SSO or MFA can't use AI agents yet. An agent's token isn't tied to a sign-in, so those
  organizations refuse it, as they refuse the Slack, Discord and Teams integrations. The consent screen shows such an
  organization greyed out with "Your org requires SSO; AI agents can't connect yet" (or multi-factor sign-in). If your
  organization turns the requirement on after you connected an agent, the agent stops working the next time it
  refreshes its access.

## Connect your agent

1. Open **Settings › You › Connections**. Its **Connect an agent** card shows the server address to give
   your client, with a copy button, instructions for each client, and whether your organization allows AI agents.

2. Add By Dawn to your client with that address, as **Connect an agent** shows for your client. [Connect an AI agent
   (MCP)](https://docs.bydawn.com/developers/mcp/#connect-your-client) has the same steps for each client.

3. Your client opens By Dawn in your browser. Sign in if it asks, then pick the **organization** the agent will work in,
   and tick what it may do (see [What an agent may do](#what-an-agent-may-do)).

4. Choose **Allow**. By Dawn sends you back to your client, and you can close the tab.

Your client is now connected and listed under **Connected agents** in **Settings › You › Connections**. An agent works
in one organization, so if you're in several, connect once for each.

## What an agent may do

You choose these when you connect. You only see the ones your organization allows and your client asked for.

| Permission | Scope | Lets the agent |
|---|---|---|
| Read tickets | `tickets:read` | read projects, tickets, comments, members, columns, labels, cycles and epics. Always on. |
| Change tickets | `tickets:write` | create and update tickets, move them, comment, link tickets together and triage |
| Start workers | `workers:start` | start and stop an agent worker on a ticket |
| Answer checkpoints | `mission:answer` | approve or send back a plan, pick an option at a [checkpoint](https://docs.bydawn.com/mission-checkpoints/), and answer a worker's questions |

None of these goes beyond your own role. If you can't move a ticket in By Dawn, your agent can't move it either, and it
never sees a restricted project you aren't a member of. No agent can merge, delete or archive, or change settings.

## See and disconnect your agents

The **Connected agents** card in **Settings › You › Connections** lists every client you've connected: its name, the
organization, what it may do, when you connected it and when it was last used. Choose **Disconnect** next to one, and
confirm, to disconnect it. It stops working within seconds, and to use it again you connect it again.

Revoke a client you no longer use, or one on a computer you've lost. Connecting a client again later in the same
organization updates what it may do rather than adding a second entry.

## Turn it on for your organization

AI agents are off for every organization until an owner or admin turns them on. Members don't see these settings.

1. Open **Settings › Organization › Security** and find the **AI agents (MCP)** card.

2. Turn on the switch. Members can now connect their agents.

3. Choose which permissions members may give an agent (see [What an agent may do](#what-an-agent-may-do)). Reading
   tickets (`tickets:read`) is always included. Changing tickets and answering checkpoints start on. Starting workers
   (`workers:start`) starts off, because a worker an agent starts runs on your
   organization's seats, the same as one a person starts. Turn it on if you're happy for members to start work from
   their agent.

Lowering what's allowed applies to existing connections the next time their agent renews its sign-in, within 15
minutes: a connection keeps only the permissions that are still allowed.

### See and revoke members' connections

The **AI agents (MCP)** card also lists every member's connected clients: who, which client, what it may do, and when
it was last used. Choose **Revoke** to disconnect one, for example a client nobody recognises.

### Turn it off

Turn off the switch and every agent in the organization stops working within seconds. Connections aren't deleted:
turn the switch back on and they work again, without anyone reconnecting. To end one person's connections for good,
revoke them on the card.

> **Note:** Removing someone from the organization, or lowering their role, disconnects their agents. Everything an agent did
> stays on the tickets, under the member's name.

## FAQ

**Can I see what an agent changed?**

Yes. The ticket's timeline shows each change with the member who made it, "via MCP" and the client's name, such as
"via MCP (Claude Code)".

**Does the agent see projects I can't?**

No. It sees exactly what you see. A restricted project stays hidden unless you're a member of it.

**My agent stopped working and asks me to sign in again. Why?**

Its connection ended: you or an admin revoked it, it went 30 days unused, AI agents were turned off for the
organization, or your role changed. Connect it again. If AI agents are off, ask an owner or admin.

**Is this the same as an API key?**

No. An [API key](https://docs.bydawn.com/api-keys/) belongs to the organization and is for scripts and services. An AI agent acts as one
person, with that person's access, and stops when they leave.

## Next

- [Connect an AI agent (MCP)](https://docs.bydawn.com/developers/mcp/): each client's setup, every tool and how the sign-in works.
- [Security](https://docs.bydawn.com/security/): the rest of the Security section.

Source: https://docs.bydawn.com/ai-agents/