# User Role based access in MCP

**URL:** <https://community.directus.com/t/user-role-based-access-in-mcp/1840>\
**Category:** Help\
**Tags:** mcp\
**Created:** [January 25, 2026, 7:14am UTC](https://community.directus.com/t/user-role-based-access-in-mcp/1840 "2026-01-25T07:14:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joothis](https://sea2.discourse-cdn.com/flex002/user_avatar/community.directus.com/joothis/32/1370_2.png) [@Joothis](https://community.directus.com/u/Joothis)\
**Post date:** [January 25, 2026, 7:14am UTC](https://community.directus.com/t/user-role-based-access-in-mcp/1840/1 "2026-01-25T07:14:03Z")

</div>

Hi Directus team,

I’m working on a **multi-user application** using **Directus + MCP**.

#### My setup:

- Each user performs certain **operations** , and

- Each operation result is stored as a **record in a Directus collection**.

- Using **Directus access policies** , I can manually restrict access so that:

**The problem (with MCP)**

When enabling **Directus MCP** :

- MCP resources seem to be **globally accessible.**

- If an MCP client (LLM / agent) queries a collection:

- This breaks **user-level isolation** in a multi-user environment

So my concern is:

> **How does Directus MCP enforce access policies per user context?**

---

<div class="post-metadata">

**Author:** ![rijkvanzanten](https://sea2.discourse-cdn.com/flex002/user_avatar/community.directus.com/rijkvanzanten/32/31_2.png) [@rijkvanzanten](https://community.directus.com/u/rijkvanzanten)\
**Post date:** [February 11, 2026, 8:30pm UTC](https://community.directus.com/t/user-role-based-access-in-mcp/1840/2 "2026-02-11T20:30:32Z")

</div>

Heya @Joothis!

MCP enforces access policies the same way the REST and GraphQL endpoints do. It’s all based on the token you use to authenticate. The `accountability` object (user, role, permissions) from your token gets passed into every operation MCP performs, so row-level filters, field-level restrictions, and collection access all apply as expected.

If you’re seeing all records when querying through MCP, it’s likely that the token you’re using belongs to an admin user or a role that doesn’t have the row-level access filters configured. I’d double check what token your MCP client is using; ideally you’d create a dedicated Directus user per MCP client with the minimal permissions needed, including the “current user” filter on the collections you want to scope.

There’s some more info on this in the [MCP Security docs](https://docs.directus.io/guides/ai/mcp/security.html) 🙂