Go to Plugins > MCP Server > Configure.
| Setting | Effect |
|---|---|
| Let apps connect by signing in (OAuth) | Needed for the Claude and ChatGPT apps, and the easiest way for Claude Code and Codex. On by default. |
| Allow anonymous access | Clients without a key or sign-in can read public records. Off by default. |
| Read-only mode | Hides every tool that changes the site. |
| Allow deleting | Offers delete_resources, delete_page and delete_exhibit_page. Off by default. |
| Visibility of new records | Private unless marked public (default), always private, or public unless marked private. "Always private" also keeps assistants from making existing records, pages and exhibits public. |
| Intake collection | Items created through MCP without a collection go into this one, for review. |
| Notes for AI assistants | Added to the guidance sent to every client, for example your house style for dates, or which item type to use. |
| Allowed browser origins | For browser-based clients such as the MCP Inspector, one origin per line. Desktop and command-line clients need none. |
| Disabled tools | Hides individual tools from every client. ✎ marks tools that change the site. |
Who can do what
An assistant acts as the Omeka user who connected it, through Omeka's own permissions:
- Every role can read what it can see in the admin (researchers see private records).
- Contributors can create items and edit and delete their own.
- Admins can work with every item, collection, file, simple page and exhibit.
- Only Super Users can change general settings, the navigation and theme settings, as in the admin.
Write tools are offered only to users who can add items, only to connections allowed to edit, and not in read-only mode. When users connect an app by signing in, they choose on the consent page whether it may edit.
API keys
Users who connect with an API key create one on their user page in the admin (Users > (user) > API Keys). Omeka shows the API Keys tab only while the REST API is turned on under Settings > API; the MCP endpoint itself does not need the REST API. Keys are sent as Authorization: Bearer <key>, or, for servers that drop that header, added to the endpoint address: https://your-site/mcp?key=<key>. A key in an address ends up in server logs, so prefer the header.