Capability sets let you group related capabilities on an MCP server so you can assign them together. Instead of selecting individual capabilities each time you grant access, create a capability set once and reuse it when assigning access to end users, groups, or roles.
For example, on a NetSuite MCP server you might create an Order Management capability set for sales order operations and a Reporting capability set for read-only reporting tools. You can then assign the appropriate set based on each user's responsibilities.
Note: Capability sets are optional. To grant access to every capability on an MCP server, select All capabilities (or Select all) when assigning access.
Before you begin
- You must have the administrator access level
- Your account must be multi-environment. Capability sets aren't available on legacy sandbox-only accounts
- The MCP server must already exist
- The MCP server must have one or more capabilities available
Create a capability set
- Go to AI studio → MCP server → server → Access tab.
-
In the Capability sets section, select + Create capability set. If you have previously created a capability set, select + Create capability set in the upper right side of the page.
- Enter a Name.
- Enter an optional description.
- In the Capabilities tab, select + Add capabilities to select Tools, APIs, Prompts, and Resources. Select Save to view the selected capabilities in the set.
-
In the Access tab, select Users, Groups, or Roles, and assign the required users, groups, or roles. See Create and manage end user groups, Invite and manage end users, and Create and manage end user roles.
- Select Save & close. The capability set is now available when assigning access to end users, groups, and roles.
Assign a capability set
You can assign a capability set to end users, groups, or roles to grant access to its capabilities. Assign it from the capability set's own Access tab.
- Go to AI studio → MCP servers → server → Access tab → Capability sets, and open the set.
- In the Access tab, use the Users, Groups, and Roles tabs to assign the set to specific end users, groups, or roles.
- Select Save & close.
The account admin screens for groups and end users don't offer a capability set picker.
Manage capability set
To see all MCP servers in your account, Go to the AI studio → MCP servers → server → Access tab → Capability set. It displays the following details:
- Name/description - Displays the name and description you gave your capability set
- Capabilities: Displays the number of capabilities added
- Actions: You can perform the following action for each capability set:
-
Edit: Open a capability set and update its name, description, or capabilities and select Save.
Note: Changes automatically apply everywhere the capability set is assigned. Users gain or lose capabilities based on the updated definition.
- Clone: Copies the set into a new draft named "Clone - {name}" and opens the create drawer. Nothing is saved until you save the clone
-
Delete: Select Delete and confirm the deletion. Access granted through the capability set is converted to direct capability access for its assigned end users, groups, and roles. When roles use the set, the confirmation message states that their accessible capabilities convert to direct capabilities.
Note: Deleting a capability set removes the set itself, but doesn't revoke access. Each assignee keeps the capabilities the set contained at the time of deletion, and they show as Direct afterward.
How capability sets work
Capability sets are scoped to a single MCP server. A capability set can include any combination of the server's tools, APIs, prompts, and resources, and the same capability can belong to multiple capability sets.
When assigning access, you can combine capability sets with individual capability selections. End users receive the combined access from all selected capability sets, any individually selected capabilities, and their group and role memberships.
If you need to grant access to every capability on an MCP server, use All capabilities during assignment instead of creating a capability set for that purpose.
Capability sets are included when you install an MCP server from a Marketplace template or upload one from a ZIP file. Each installed capability set retains its name, description, and capabilities, referencing the installed MCP server's own capabilities. Access assignments aren't included, so you must assign the capability sets to the required end users, groups, or roles after installation