Identity / Automatic MCP distribution
Automatic MCP distribution
Configure automatic MCP distribution for your team in Speakeasy.
Automatic MCP distribution lets administrators manage team access in one place. Speakeasy keeps the team’s plugin current as server access changes, reducing the ongoing work of maintaining it. Team members get their tools through that plugin in their client.
How automatic distribution works
Section titled “How automatic distribution works”When directory sync creates a role, Speakeasy creates a matching plugin and assigns it to that role. Roles created manually follow the same flow. If a matching plugin already exists, Speakeasy reuses it, preserving its contents and other assignments.
Assign the role on an MCP server’s Team Access tab. Speakeasy adds the server to the role’s plugin in that project and publishes the update to the connected marketplace.
Before you start
Section titled “Before you start”An organization administrator is required to set up automatic MCP distribution.
Use an MCP server in the same project as the role’s plugin.
Connect the project’s marketplace using Marketplace setup, and complete the setup for the team’s client. On MCP Gateway > Plugins, confirm that Your project marketplace is Up to date and that the team can access it in their client. This connection lets Speakeasy publish subsequent changes automatically.
Example: give Engineering the GitHub server
Section titled “Example: give Engineering the GitHub server”Suppose the Engineering team needs the GitHub MCP server. Use the Engineering role from directory sync. If the team has no mapped role yet, select Create role… in its role mapping. For organizations managing roles manually, create Engineering under Organization settings > Team > Roles & Permissions and manage membership under Assign Members.
In the project containing Engineering’s plugin, open MCP Gateway > MCP, select the GitHub server, and open Team Access. Select Grant access > Role and choose Engineering. Speakeasy adds GitHub to the matching plugins and publishes the update.
The Engineering row links to each matching plugin. Open Engineering’s plugin and check that GitHub appears under MCP Servers as Published. Confirm that the marketplace is Up to date before sharing it with the team. If changes remain pending, select Sync changes.
The administrator can deploy the plugin centrally or provide installation settings privately to team members. Follow the Claude Code installation guide or the instructions for the team’s client. A team member applies those instructions, opens the client, and completes any requested GitHub authentication.
To try the tools, ask the client: Use the GitHub tools to list open issues in example-org/engineering-demo. Replace the example with a repository the member can access. The client should call the GitHub server and return its open issues, or an empty result if there are none.
When access changes
Section titled “When access changes”Removing Engineering from the GitHub server’s Team Access removes GitHub from the plugins assigned to Engineering in that project. A plugin keeps GitHub if another role assigned to it still has access. Speakeasy preserves the other contents and publishes the update.
Marketplace installations receive changes through the client’s update process. Follow the Claude Code or Cursor update and reload instructions. ZIP installations need a fresh download, replacement of the local package, and a client reload.
Administrators can also remove a server directly from a plugin. Speakeasy respects that choice; a later server-access grant or role assignment can add it again. To revoke access to the server itself, change its Team Access rules. Those rules control tool calls even while a client holds an older plugin configuration.
Deleting a role removes its plugin assignments but preserves the plugin, its contents, and any other audiences.
If the plugin or server is missing
Section titled “If the plugin or server is missing”Role-plugin setup runs in the background. Check MCP Gateway > Plugins in the organization’s oldest active project after setup completes. For servers in another project, set up a role-assigned plugin there. For an existing plugin, check that the server is in the same project, is enabled, and is accessible to the assigned role. An administrator’s deliberate removal from the plugin is preserved.
Servers containing Platform tools need an explicit addition. Open the plugin’s MCP Servers section, select Add Server, choose the server, and select Add. This applies even when the server also contains other tools.
If the server appears in the published plugin but not in the client, check the client’s installation and update status. If it appears but calls fail, check sign-in and repository access. Contact Speakeasy support if setup remains incomplete.