Share an MCP with a friend

The MCP sharing pilot adds My MCPs, Shared by me, Shared with me and Teams under one MCP navigation item. Personal email sharing is available only in an environment that enables this feature and deploys the personal-sharing update. Existing connections and team access continue to work.

Share one connection

1. Open MCP > My MCPs. A provider can have several connections with different labels, such as Linear / Work and Linear / Personal.
2. Choose Share on the exact connection you want to share.
3. Enter your friend's email and confirm access to the selected connection.
4. Send the invitation. Review the recipient and access in Shared by me.

Sending an addressed personal invitation is your approval. The recipient does not join your team or gain access to its projects, agents or history. Your provider keys stay on the backend; the recipient uses the FlyMyAI proxy.

The invitation expires after 24 hours. Access lasts seven days by default and up to 30 days through the API. All personal shares from one owner use that owner's monthly usage limit of 500 calls/$5. Each recipient pays FlyMy execution from their own balance after explicitly accepting billing. The owner's balance is never a fallback. Charges from the connected provider remain separate. Read access may expose data in the connected account.

The current pilot permits only reviewed Linear issue summaries, Notion search and Composio Gmail summaries. Unsupported connectors show that sharing is unavailable. Writes are denied before contacting the provider. The action-permission editor is not part of this version. All MCP types must have an explicit sharing design; that requirement does not automatically publish connections or enable new adapters.

Accept and connect

The email names the sender and connection. Click Accept invitation, sign in or create an account using the email that received it, and verify that email. Review and accept the FlyMy execution charges. If you selected Accept before registration, that consent and invitation can resume after sign-in for up to 24 hours. Withdrawing consent cancels automatic acceptance. Existing users can review and accept it directly.

The public invitation number grants no access by itself. A different account cannot accept it. No second approval or team membership is needed for a personal invitation. If email verification is still pending, verify it and choose I've verified my email - try again.

Open MCP > Shared with me to see the owner's username, connection label, expiry and payer. Choose Connect, name a device and copy the provided Claude Code or Cursor configuration. A device token is shown once and works only with that specific shared connection. Adding another MCP does not expand an existing token. Device tokens and provider credentials are different credentials.

You can also use FlyMyAI Agents MCP to discover and call the shared read tools. No owner API key or provider token is needed.

Revoke and reconnect

In Shared by me, choose Cancel invite before acceptance or Revoke afterwards. The recipient can choose Leave. New calls stop immediately; other connections shared with the same person stay available. The original recipient remains the payer for work already sent to the provider; a revoked recipient cannot collect its result or replay it.

Revoke and Leave also invalidate outstanding invitations for that connection and recipient. An old invitation cannot restore access; the owner must send a new one.

You can revoke individual devices under Connect. When the owner reconnects or changes the provider account, access requires fresh approval. The owner sends another invitation from that exact connection; after acceptance, the recipient creates a fresh device token. Old tokens are never reactivated.

API and FlyMyAI Agents MCP

The REST API uses the recipient or owner's verified personal identity. The platform MCP management tools require a personal API key supplied by the client; bound-customer and operator-fallback credentials cannot administer shares.

Action	REST path below /api/v1/	Agents MCP tool
List connections	GET mcp-shares/?scope=received or sent	list_mcp_shares
List invitations	GET mcp-share-invitations/?scope=received or sent	list_mcp_invitations
Invite by email	POST mcp-share-invitations/	invite_mcp_user
Accept	POST mcp-share-invitations/{id}/accept/	accept_mcp_invitation
Cancel pending	DELETE mcp-share-invitations/{id}/	cancel_mcp_invitation
Revoke or leave	DELETE mcp-shares/{id}/	revoke_mcp_access
Discover read tools	GET mcp-shares/{id}/tools/	list_shared_mcp_tools
Invoke read tool	POST mcp-shares/{id}/call/	call_shared_mcp
Create/list devices	POST/GET mcp-shares/{id}/devices/	Use the REST API or UI
Revoke device	DELETE mcp-shares/{id}/devices/{device_id}/	Use the REST API or UI
View call metadata	GET mcp-shares/{id}/activity/	Use the REST API or UI

Invitation creation requires source_id, email, accept_sharing: true and an Idempotency-Key header of 8-128 printable non-space ASCII characters. Acceptance requires the recipient's accept_billing: true. Keep the same key for a retry of the same operation. The MCP tool takes that value as operation_key. Runtime calls use the discovered name and arguments with their own stable operation key. Never automatically retry a call whose outcome is unknown.

Lists contain at most 25 entries and a next_cursor; callers explicitly request the next page. Tool discovery uses nextCursor. Inputs are limited to 64 KiB, responses to 256 KiB. Audit contains action, status, price and timestamps, with 30-day retention; arguments, message content and owner secrets are omitted.

Python clients provide synchronous client.shares and asynchronous async_client.shares methods. For example:

invitation = client.shares.invite(
    source_id,
    "friend@example.com",
    accept_sharing=True,
    idempotency_key="invitation-operation-1",
)
# In the recipient's authenticated client:
share = recipient.shares.accept(invitation.id, accept_billing=True)
tools = recipient.shares.tools(share.id)
# In the owner's client:
client.shares.revoke(share.id)

Team email invitations

Use MCP > Teams > Invitations, or the team's profile invitation dialog. Email invitations work for new users too. Team invitations disclose project and history access and still require recipient consent plus owner approval. The team's balance pays team calls. Personal sharing does not change that contract. See MCP teams for roles and team administration.

Device limits are shared across connections from the same owner: at most 10 active device tokens and 20 new tokens per day. Revoke an unused token from one of those connections before creating more. Personal protocol requests are limited to 20 per minute per recipient/owner pair. Rejected call details are limited to 20 audit entries per day for each recipient; this cannot consume another recipient's denial audit allowance. Runtime receipts retain the normal call history and settled charges.