Keys and allow lists
Keys
Agents connect with an MCP key, which starts with l10m_. Owners and admins create them on the project's MCP page. A key is shown once, stored only as a hash, and opens its own project's server and no other. Revoke it on the same page and it stops working at once.
How many keys a server may have depends on your plan: see Plans and limits. After a downgrade, keys over the new number are kept but suspended, newest first, until the plan comes back or you revoke older ones.
Which tools are on
When the server is made, its reads (GET and HEAD) are on and every write is off. Owners and admins turn each tool on or off. At most 60 tools can be on at once: an agent chooses worse from a long list.
Allow lists
On Pro and up, a key can carry an allow list: it sees only the tools on that list that are also on for the server. A key without one sees every tool that's on. On Free, every key sees every tool that's on.
| Answer | When |
|---|---|
| “Tool allow lists come with Pro.” | An allow list on Free. |
| “Choose at most 60 of this server’s tools.” | An allow list too long, or with a tool name that isn't one. |
| “This server has its … keys. Revoke one first.” | The server has as many keys as the plan allows. |
Where this comes from
app/hosted-mcp/_lib/keys.tsapp/hosted-mcp/_lib/server.tsapp/workspace/actions.tsapp/workspace/_lib/quotas.ts