MCP tools missing although I am an admin

Area: Claude and MCP · Updated: 2 Nov 2026 · Auf Deutsch · All articles

Symptoms

  • You are owner or admin of the organization, but Claude does not know tools such as contacts_search, sales_lists_create or the administration tools.
  • auth_whoami lists your role as owner or admin and still names scopes under missingFromRole.
  • Connecting again in Claude did not help: the old rights came back.

Cause

  • Before 2 Nov 2026 a connection stored the rights of the moment it was made. Rights the product added later (e.g. the Sales Engine) and a later role change did not reach it, and a token refresh or reconnect without a new consent kept the old list.
  • The connection was restricted on purpose under „Anpassen“ on the consent page (e.g. Sales Engine only read). It keeps exactly that selection.
  • An open chat keeps the tool list from when it started.

How to fix it

1. Check the mode of the connection

  • In the dashboard: X3 Konto › Sicherheit › Angemeldete Geräte und Verbindungen, column „Rechte“
  • With Claude (MCP): auth_whoami

rights.mode is „role“ (All rights of your role) or „custom“ (restricted). The table shows „Alle Rechte Deiner Rolle“ or „Eingeschränkt: …“ for every app and AI connection.

2. Reset a restricted connection

  • In the dashboard: X3 Konto › Sicherheit › „Auf alle Rechte zurücksetzen“ next to the connection
  • With Claude (MCP): No MCP tool (widening a connection's rights is up to the person in the browser, never to the connection itself)

Acts at once on the running connection, no need to connect again.

3. Start a new chat

  • In the dashboard: Claude › New chat
  • With Claude (MCP): No MCP tool (an open chat only knows the tools from when it started)

How to tell it worked

  • auth_whoami shows rights.mode „role“, missingFromRole is empty and fix is null.
  • The tools of your role (also the Sales Engine) are listed in a new chat.

What happens now automatically

Every OAuth connection (Claude, ChatGPT, other MCP apps, the X3 App, the Sales Engine) holds all rights of your role by default. X3 works them out at every request and every token refresh from your current role: rights the product adds later and a promotion apply at once, a demotion takes rights away at once. You never connect again for that.

Connections made before 2 Nov 2026 that were never restricted on purpose were switched to this mode automatically (each switch is in the audit log). The X3 App keeps its fixed exclusions (no administration, no Sales Engine), secret keys (sk_) keep their explicit scopes, because a key has no role.

When a connection is restricted

On the consent page „Anpassen (optional)“ lets you untick rights. Then the connection keeps exactly that selection and is shown as „Eingeschränkt: …“. Connecting again shows „Alle Rechte Deiner Rolle“ preselected again and does not take over the old selection. To widen an existing restricted connection, use „Auf alle Rechte zurücksetzen“ in X3 Konto › Sicherheit.