User and admin MCPs
Let an agent use your app through a connection the user can approve and revoke.
MCP lets an agent talk to your application through a set of named tools. In Nextbase, those tools use the same accounts and workspace permissions as the website.
Two different connections
User MCP is for a person using the app. The connection is limited to the workspace they choose. It can read account context and list projects. Convex kits can also create a project with optional write permission.
Admin MCP is for an application administrator. It can read user and workspace information across the application. It requires a current admin role and has its own endpoint and credentials.
Keeping these separate makes the permission request easier to understand. The user approves exactly the kind of access the agent needs.
OAuth is included
The agent opens the app's consent page, the user signs in, and the app shows the callback address, workspace and permissions. After approval, the client receives credentials for that connection.
You can inspect and disconnect connections from the website. You can continue using the app's normal login at the same time.
Where are the endpoints?
Supabase, Neon and D1 serve the User MCP from the web app's origin, followed by /mcp/user, and the Admin MCP from the separate admin app's origin, followed by /mcp/admin. Each origin only serves its own audience; the other path returns 404.
Convex uses the backend's .convex.site origin. Its connection settings show the exact backend address. The two deployed demos are listed in connect an agent.
Start with the User MCP unless you need application-wide admin tools. Follow the connection guide for the full flow.