Share an MCP with a friend

The MCP sharing pilot adds My MCPs, Shared by me and Teams under one MCP navigation item. Connections other people share with you appear in My MCPs itself, after your own, with an Owner column: who shared each one, their email, and the team that owns it. Existing connections and team access continue to work.

Share one connection

1. Open MCP > My MCPs. A provider can have several connections with different labels, such as Linear / Work and Linear / Personal.
2. Choose Share on the exact connection you want to share.
3. Enter your friend's email, pick the Access period (1, 7, 14 or 30 days, or No expiry until you revoke it) and confirm access to the selected connection.
4. Send the invitation. Review the recipient and access in Shared by me.

Sending an addressed personal invitation is your approval. The recipient does not join your team or gain access to its projects, agents or history. Your provider keys stay on the backend; the recipient uses the FlyMyAI proxy.

The invitation expires after 24 hours. Access lasts the period you picked: seven days by default, up to 30 days, or with no end date until you revoke it (access_days: 0 through the API or invite_mcp_user). Each recipient pays FlyMy execution from their own balance after explicitly accepting billing, with no monthly cap. The owner's balance is never a fallback. Charges from the connected provider remain separate. Shared access can read and change data in the connected account.

The recipient can use every action of the shared connection, reads and writes, and each call runs on the owner's account. Built-in FlyMyAI tools and tools that run on FlyMyAI's own key can't be shared; the app says so for those connectors. A share accepted while sharing was read-only keeps its read actions until the owner shares the connection again. The action-permission editor is not part of this version. All MCP types must have an explicit sharing design; that requirement does not automatically publish connections.

Accept and connect

If you already have a FlyMyAI account with that email, the invitation appears right away under Invitations for you at the top of My MCPs and as a row of the table: choose Accept or Decline. The email names the sender and connection too: click Accept invitation, sign in or create an account using the email that received it, and verify that email. Review and accept the FlyMy execution charges. When you accept, the person who shared gets an email. If you selected Accept before registration, that consent and invitation can resume after sign-in for up to 24 hours. Withdrawing consent cancels automatic acceptance. Existing users can review and accept it directly.

The public invitation number grants no access by itself. A different account cannot accept it. No second approval or team membership is needed for a personal invitation. If email verification is still pending, verify it and choose I've verified my email - try again. Once an invitation is accepted, declined, cancelled or expired, its link only shows that outcome.

In My MCPs, choose Use on a shared connection to see who shared it, until when you have access and that you pay for your own calls. To connect Claude Code or Cursor directly, name a device, create a token and paste the provided configuration into .mcp.json in your project (Claude Code) or ~/.cursor/mcp.json (Cursor). A device token is shown once and works only with that specific shared connection. Adding another MCP does not expand an existing token. Device tokens and provider credentials are different credentials.

If Claude, ChatGPT, Grok or another assistant is connected to FlyMyAI Agents MCP, you need none of this: it lists the connection next to yours (list_configured_tools, under shared_with_me) and calls it with call_shared_mcp. No owner API key or provider token is needed.

Your calls in the same dialog lists every call you made through the connection, newest first, with what it cost. The owner sees the same under Calls in Shared by me.

Use a shared connection in agents

Agents in FlyMyAI use your own connections first and also see the connections shared with you, with who shared each one. If you have no Notion of your own, "what is new in Notion?" uses the Notion shared with you - no names needed. If you have your own, ask for the other one: "find the Notion shared with me" or "check Alex's Notion". With several shared connections of one service the agent lists them with their owners or asks which one. Calls to shared connections, reads and writes, are billed to your balance.

Revoke and reconnect

In Shared by me, choose Cancel invite before acceptance or Revoke afterwards. The recipient can choose Stop using this connection. New calls stop immediately; other connections shared with the same person stay available. The original recipient remains the payer for work already sent to the provider; a revoked recipient cannot collect its result or replay it.

Revoke and Leave also invalidate outstanding invitations for that connection and recipient. An old invitation cannot restore access; the owner must send a new one.

You can revoke individual devices under Use. When the owner reconnects or changes the provider account, access requires fresh approval. The owner sends another invitation from that exact connection; after acceptance, the recipient creates a fresh device token. Old tokens are never reactivated.

API and FlyMyAI Agents MCP

The REST API uses the recipient or owner's verified personal identity. The platform MCP sharing tools work from your own sign-in: a personal API key supplied by the client or the OAuth sign-in of Claude, ChatGPT, Grok and other connectors. Bound-customer and operator-fallback credentials cannot administer shares. Device tokens are credentials: create them in the app or over REST with your login or a personal API key, never from a chat.

Action	REST path below /api/v1/	Agents MCP tool
What you can share	GET mcp-shares/sources/?mcp_tool=&alias=	list_shareable_mcp_connections
People from your team	GET mcp-shares/people/	list_mcp_share_people
List connections	GET mcp-shares/?scope=received or sent	list_mcp_shares
List invitations	GET mcp-share-invitations/?scope=received or sent	list_mcp_invitations
Invite by email or team member	POST mcp-share-invitations/	invite_mcp_user
Accept	POST mcp-share-invitations/{id}/accept/	accept_mcp_invitation
Cancel pending (owner) or decline (recipient)	DELETE mcp-share-invitations/{id}/	cancel_mcp_invitation
Revoke or leave	DELETE mcp-shares/{id}/	revoke_mcp_access
Discover tools	GET mcp-shares/{id}/tools/	list_shared_mcp_tools
Call a tool	POST mcp-shares/{id}/call/	call_shared_mcp
Create/list devices	POST/GET mcp-shares/{id}/devices/	Use the REST API or UI
Revoke device	DELETE mcp-shares/{id}/devices/{device_id}/	Use the REST API or UI
Call history, newest first	GET mcp-shares/{id}/activity/	list_mcp_share_activity

mcp_tool (and alias) return one toolkit's connections in one call. Each row says whether it can be shared (available), the access a new share carries and action_count; source_id returns one connection with its actions. An unavailable row says why in reason (needs_setup, connection_needs_reconnect, connection_identity_changed or nothing_to_share) and, when its owner can fix it, links the setup in connect_url. An unanswered invitation past its 24-hour window reads expired. A personal share has no call or spend ceiling: its rows return call_limit and spend_limit as null.

Invitation creation requires source_id, email, accept_sharing: true and an Idempotency-Key header of 8-128 printable non-space ASCII characters. access_days is 1-30, or 0 for no end date until revoked; it is 7 when omitted. Acceptance requires the recipient's accept_billing: true. Keep the same key for a retry of the same operation. The MCP tool takes that value as operation_key. Runtime calls use the discovered name and arguments with their own stable operation key. Never automatically retry a call whose outcome is unknown.

Lists contain at most 25 entries and a next_cursor; callers explicitly request the next page. Tool discovery uses nextCursor. Inputs are limited to 64 KiB, responses to 256 KiB. Audit contains action, status, price and timestamps, with 30-day retention; arguments, message content and owner secrets are omitted.

Python clients provide synchronous client.shares and asynchronous async_client.shares methods. For example:

invitation = client.shares.invite(
    source_id,
    "friend@example.com",
    accept_sharing=True,
    idempotency_key="invitation-operation-1",
)
# In the recipient's authenticated client:
share = recipient.shares.accept(invitation.id, accept_billing=True)
tools = recipient.shares.tools(share.id)
# In the owner's client:
client.shares.revoke(share.id)

Team email invitations

Use MCP > Teams > Invitations, or the team's profile invitation dialog. Email invitations work for new users too. Team invitations disclose project and history access and still require recipient consent plus owner approval. The team's balance pays team calls. Personal sharing does not change that contract. See MCP teams for roles and team administration.

Device limits are shared across connections from the same owner: at most 10 active device tokens and 20 new tokens per day. Revoke an unused token from one of those connections before creating more. Personal protocol requests are limited to 20 per minute per recipient/owner pair. Rejected call details are limited to 20 audit entries per day for each recipient; this cannot consume another recipient's denial audit allowance. Runtime receipts retain the normal call history and settled charges.