Administrative controls

Project administrators decide what each MCP token can do.

#Per-token settings

Setting	Options	Default
Identity	Any identity in the project	Required
Tools enabled	remember, recall, forget, memory_status	All except forget
Default visibility for remember	private, audience, project	private
Recall token cap	Up to plan limit	Plan limit
Expiry	Date or none	90 days

#Read-only tokens

Disable remember and forget for tokens used in shared or experimental clients.

#Revocation and audit

Revoke a token to stop it immediately. Every tool call appears in the request log with the token, tool and identity, retained per your plan’s API log retention (7 days, 90 days or unlimited).