The hosted MCP connection signs in through OAuth. It acts as your account in the workspace approved for that connection, subject to your current access there.
Choose the workspace
Choose the intended workspace on the connection's consent screen. You can select a workspace you belong to, including one you were invited to; membership does not automatically give you permission for every action or app.
New connections stay bound to the approved workspace. Switching workspaces in the Overskill dashboard does not move that connection. Reconnect and approve the intended workspace when you need a different one. Older connections created before the workspace picker may use your current workspace; reconnect them to make the choice explicit.
Have the connected tool list the apps it can access before asking it to change anything. Builder work spends the workspace's credits.
Read-only access
Read and write permissions are checked separately. An OAuth client can request read scopes, but the scopes shown on its consent screen are the ones that client requested. Do not approve a request for write access and assume the connection is read-only because you told the assistant not to edit.
Whether your MCP client lets you customize requested scopes depends on that client. The hosted /mcp endpoint requires OAuth; a read-only Partner API key is not a replacement credential for it. For programmatic reads with a key, use the Partner REST API and a key with only the required read permissions.