Understanding Workspaces
Workspaces are the organizational boundary in MCPBundles. Everything you do — MCP servers, credentials, A2A agents, tool executions — lives inside a workspace. The workspace determines who can see and use your resources.
Personal vs Team Workspaces
Every user gets a personal workspace on signup. When you invite someone, your workspace becomes a team workspace. There's no explicit toggle — the workspace evolves naturally based on membership.
| Personal Workspace | Team Workspace | |
|---|---|---|
| Members | Just you | 2 or more |
| MCP servers | Only you can see and use them | All members see and use all MCP servers |
| Credentials | Private to you | Usable by all members; viewable/editable by owner only |
| A2A Agents | Private to you | Visible to all members |
| History | Only your executions | All members' executions with attribution |
| Studio threads | Private | Private (always personal, even in team workspaces) |
When to use each
Personal workspace — Your private space. Personal API keys, experimental MCP servers, side-project A2A agents. Nothing here is visible to anyone else.
Team workspace — Your team's shared environment. Connect HubSpot once and everyone can use it. Create an A2A agent and the whole team can see it running. One person sets up an MCP server and it works for everyone — zero setup for new members.
What's shared in a team workspace
When your workspace has 2+ members, everything is shared by default:
MCP servers
When any member enables an MCP server, it's enabled for the workspace. All members can see it, open it in Studio, and use its tools. No per-user "enable" step — if it's on, it's on for everyone.
Credentials
When you connect a credential (OAuth or API key) in a team workspace, all members can use it — but only the person who created it can view or edit it. Alice connects HubSpot → Bob opens the HubSpot MCP server → all tools work immediately using Alice's credential. Zero setup for Bob.
Bob can see that a HubSpot credential exists and who added it, but he cannot see the API key values or modify the credential. The credential card shows "Added by Alice" so it's clear who owns it.
Each MCP server can bind multiple accounts for the same provider when you need them (for example two Stripe accounts on one server). Use Connect a different … account on the server’s Connections section, or Remove from server to drop a binding without deleting the saved credential. If two completely separate setups should never share tools, create separate MCP servers instead.
A2A Agents
All workspace A2A agents are visible to all members. You can see other members' agent configurations and run history. Only the creator (or an Admin) can edit or delete an agent.
Tool executions
All tool executions are visible with user attribution — you can see who ran what and when.
AI API keys
AI keys (for Studio and A2A agent execution) are workspace-level. Any member's OpenAI key can power any workspace A2A agent or Studio session.
What stays private
Some things remain personal even in team workspaces:
| Resource | Why private |
|---|---|
| Studio threads | Chat history is personal — your AI conversations are yours. Like Slack DMs vs channels. |
| MCPBundles API keys | Machine auth tokens for API access. Personal security credentials. |
| Proxy connections | Per-device proxy state. |
The workspace boundary
The workspace is the privacy boundary. If you put something in a team workspace, it belongs to the workspace. If you don't want to share something, put it in your personal workspace.
This is the same model as:
- Don't put personal files in the company Google Drive
- Don't post personal messages in the company Slack channel
- The container determines the audience
The workspace switcher (next to the logo) is always available. Switch to your personal workspace for private credentials, switch back to the team workspace for shared work.
Inviting a team member
To invite someone to your workspace:
- Open Settings → Members (
/w/{workspace}/settings/members). - Enter their email and choose a role (Viewer, Member, Admin, or Owner).
- Send the invite — they accept from the email link and land in your workspace.
First invite — the transition moment
When you invite the first member to a workspace, it transitions from personal to team. The invite flow shows a clear warning:
Inviting a member makes this a team workspace. All MCP servers, credentials, and A2A agents in this workspace will be shared with all members.
This is the only gate. After that, everything in the workspace is shared — no confirmation modals on every action.
Roles and permissions
Workspace roles control what you can change, not what you can see. In a team workspace, all members see the same data. The table below matches the product’s ROLE_PERMISSIONS mapping (Viewer = run tools only; Member and above can manage MCP servers, credentials, and agents).
Viewer has only tools:execute — read-and-run connected servers and agents, with no changes to servers, credentials, or agents. Member and above add bundles:manage, credentials:manage, and agents:manage (connect or turn off MCP servers, manage credentials, build agents). Admin and Owner add workspace:manage and billing:manage.
| Action | Viewer | Member | Admin | Owner |
|---|---|---|---|---|
| View workspace MCP servers & agents | Yes | Yes | Yes | Yes |
| Run tools (Studio, AI clients) | Yes | Yes | Yes | Yes |
| Connect / turn off MCP servers | No | Yes | Yes | Yes |
| Connect or edit credentials | No | Yes | Yes | Yes |
| Create or edit A2A agents | No | Yes | Yes | Yes |
| Edit/delete another member's MCP server | No | No | Yes | Yes |
| Edit/delete another member's A2A agent | No | No | Yes | Yes |
| View another member's credential secret values | No | No | No | No |
| Disconnect another member's credential | No | No | Yes | Yes |
| Manage workspace members | No | No | Yes | Yes |
| Manage billing | No | No | Yes | Yes |
| Transfer ownership | No | No | No | Yes |
Admin and Owner additionally manage membership and billing, and can edit or delete other members’ MCP servers and agents where the UI exposes those controls. No role can view another member’s credential secret values.
New member onboarding
When someone joins a team workspace, everything works immediately:
- They see all enabled MCP servers on the MCP servers page
- They open any MCP server in Studio — all tools work using workspace credentials
- They see all workspace A2A agents and their run history
- They see all workspace tool executions with user attribution
No setup required. No "connect your own credentials" step. The workspace's credentials are already working — new members can use them without seeing the secret values.
Cross-workspace isolation
Workspaces are completely isolated from each other. If you're a member of both "Acme Sales" and "Acme Engineering":
- Credentials in "Acme Sales" are invisible from "Acme Engineering"
- MCP servers enabled in one workspace don't appear in another
- A2A agents and history are workspace-specific
The workspace switcher lets you move between workspaces. Each one is its own self-contained environment.
Billing and plan limits (per workspace)
Paid plans attach to a workspace, not to your email domain or company name. Two colleagues with @yourcompany.com addresses each have their own personal workspace by default. Upgrading or subscribing in one workspace does not move plan limits to another person's workspace.
| What you see | What it means |
|---|---|
Account → Plan (/account/plan?workspace=…) with workspace A selected in the switcher | Usage and plan limits for workspace A only |
| A colleague upgraded "the company account" | They likely paid on their workspace (or a team workspace you are not using in Claude) |
| Usage limit errors in Claude after IT upgraded | Claude is probably still connected to a Free personal workspace — not the paid one |
Claude, Cursor, and other OAuth clients bind to the workspace you pick during MCPBundles authorization. Reconnecting the same AI client without switching workspace in the dashboard first keeps billing and limits on the old workspace.
To use a paid team workspace:
- Open the workspace switcher (next to the logo) and select the team workspace that has the subscription.
- Confirm Account → Plan shows the expected plan and usage for that workspace.
- In your AI client, disconnect MCPBundles and connect again so OAuth binds to the active workspace (or use a workspace API key for headless setups — see Connecting your AI).
If IT paid on the wrong login, email support@mcpbundles.com with both account emails and which workspace should hold the subscription — the team can align billing on our side.
When a member leaves
When someone is removed from a team workspace:
- Any credentials they connected are flagged as "orphaned"
- Workspace admins are notified with details on which providers are affected
- The credentials continue working (OAuth tokens don't expire immediately)
- Admins can reconnect the credentials under an active member's account
This is proactive — the platform warns you before tokens silently expire and break tools for the team.