# Automatic MCP distribution Automatic MCP distribution lets administrators manage team access in one place. Speakeasy keeps the team's plugin current as server access changes, reducing the ongoing work of maintaining it. Team members get their tools through that plugin in their client. ## How automatic distribution works When directory sync creates a role, Speakeasy creates a matching plugin and assigns it to that role. Roles created manually follow the same flow. If a matching plugin already exists, Speakeasy reuses it, preserving its contents and other assignments. Assign the role on an MCP server's **Team Access** tab. Speakeasy adds the server to the role's plugin in that project and publishes the update to the connected marketplace. ## Before you start > An [organization administrator](/docs/ai-control-plane/org-admin/roles-and-permissions) is required to set up automatic MCP distribution. Use an MCP server in the same project as the role's plugin. Connect the project's marketplace using [Marketplace setup](/docs/ai-control-plane/mcp-gateway/plugins#marketplace), and complete the setup for the team's client. On **MCP Gateway > Plugins**, confirm that **Your project marketplace** is **Up to date** and that the team can access it in their client. This connection lets Speakeasy publish subsequent changes automatically. ## Example: give Engineering the GitHub server Suppose the Engineering team needs the GitHub MCP server. Use the Engineering role from directory sync. If the team has no mapped role yet, select **Create role…** in its [role mapping](/docs/ai-control-plane/identity/identities/directory-sync-and-roles#map-groups-and-attributes-to-roles). For organizations managing roles manually, create Engineering under **Organization settings > Team > Roles & Permissions** and manage membership under **Assign Members**. In the project containing Engineering's plugin, open **MCP Gateway > MCP**, select the GitHub server, and open **Team Access**. Select **Grant access > Role** and choose Engineering. Speakeasy adds GitHub to the matching plugins and publishes the update. The Engineering row links to each matching plugin. Open Engineering's plugin and check that GitHub appears under **MCP Servers** as **Published**. Confirm that the marketplace is **Up to date** before sharing it with the team. If changes remain pending, select **Sync changes**. The administrator can deploy the plugin centrally or provide installation settings privately to team members. Follow the [Claude Code installation guide](/docs/ai-control-plane/mcp-gateway/plugins/anthropic#install-or-update-a-role-plugin) or the instructions for the team's client. A team member applies those instructions, opens the client, and completes any requested [GitHub authentication](/docs/ai-control-plane/mcp-gateway/access/upstream-credentials#what-the-end-user-sees). To try the tools, ask the client: `Use the GitHub tools to list open issues in example-org/engineering-demo.` Replace the example with a repository the member can access. The client should call the GitHub server and return its open issues, or an empty result if there are none. ## When access changes Removing Engineering from the GitHub server's **Team Access** removes GitHub from the plugins assigned to Engineering in that project. A plugin keeps GitHub if another role assigned to it still has access. Speakeasy preserves the other contents and publishes the update. Marketplace installations receive changes through the client's update process. Follow the [Claude Code](/docs/ai-control-plane/mcp-gateway/plugins/anthropic#install-or-update-a-role-plugin) or [Cursor](/docs/ai-control-plane/mcp-gateway/plugins/cursor#updates) update and reload instructions. ZIP installations need a fresh download, replacement of the local package, and a client reload. Administrators can also remove a server directly from a plugin. Speakeasy respects that choice; a later server-access grant or role assignment can add it again. To revoke access to the server itself, change its [Team Access](/docs/ai-control-plane/mcp-gateway/access/team-access) rules. Those rules control tool calls even while a client holds an older plugin configuration. Deleting a role removes its plugin assignments but preserves the plugin, its contents, and any other audiences. ## If the plugin or server is missing Role-plugin setup runs in the background. Check **MCP Gateway > Plugins** in the organization's oldest active project after setup completes. For servers in another project, [set up a role-assigned plugin there](/docs/ai-control-plane/mcp-gateway/plugins#set-up-a-role-plugin-in-another-project). For an existing plugin, check that the server is in the same project, is enabled, and is accessible to the assigned role. An administrator's deliberate removal from the plugin is preserved. Servers containing **Platform tools** need an explicit addition. Open the plugin's **MCP Servers** section, select **Add Server**, choose the server, and select **Add**. This applies even when the server also contains other tools. If the server appears in the published plugin but not in the client, check the client's installation and update status. If it appears but calls fail, check sign-in and repository access. Contact Speakeasy support if setup remains incomplete. --- Index of every Speakeasy page for agents: [llms.txt](https://www.speakeasy.com/llms.txt). AI control plane and MCP gateway content in one file: [llms-full.txt](https://www.speakeasy.com/llms-full.txt). Any page is available as markdown by appending `.md` to its URL or by requesting it with `Accept: text/markdown`.