A connected app is something outside Foldr that acts for one of your people. It’s either an AI assistant that talks to Foldr over MCP (the Model Context Protocol), or an app that uses the Foldr API. Either way the app signs in as that person, sees what they see and can do no more than they can. Foldr’s permissions apply to every call.
Connected apps are off until an administrator turns them on. Until then, /mcp answers as if it didn’t exist.
What you’ll need
- Foldr Cloud: the Business and Enterprise plans include connected apps. On any other plan the page says “Connected apps are not included in your plan.”
- Appliance: no licence key is needed. The switch below is the only gate.
- The permission that opens Settings > Connected apps.
Turn it on
- Open Settings > Connected apps.
- On the Settings tab, switch on Allow connected apps.
- Under Who may connect apps, add the people and groups who may connect an app to their own account. Nobody can connect one until they’re listed. The permission is called Connect apps.
- Decide about approval. With Approve each self-registered app before people can use it on, an assistant that registers itself waits on the Apps tab until you click Approve. An app nobody approves within 30 days is removed.
- Check Token lifetimes. A connection lasts up to 90 days by default and ends after 30 days unused. The person then connects the app again.
Each change saves as you make it. Taking Connect apps away from someone pauses all their connected apps. Giving it back resumes them.
Most assistants register themselves the first time someone connects. If one asks for a client ID instead, click Add an app on the Apps tab, give it a name and its redirect URLs, and copy the client ID and any secret straight away. Foldr can’t show the secret again.
Read, write and the destructive policy
A new app can read and search, and change nothing. Its row on the Apps tab says Read-only.
To allow changes, click Policy… on the app’s row. The dialog is called What (app name) may change.
- Read is always allowed: listing shares and folders, reading files, search, custom fields, and the person’s own sharing and activity.
- Write is what you tick in the dialog: creating and changing files (never deleting or moving), setting a custom field, and asking for something to be shared. An approver has to allow each sharing request, and the assistant is never handed a link.
- Under Where it may make changes, choose Any share the person can write to or Only these shares.
- Set a Daily limit on write calls per person per app per day (UTC), or choose No limit.
- Changes that remove or replace is a separate section, off until ticked. It applies to the Foldr API only. The MCP server has no tool that deletes, moves or replaces anything, whatever you tick.
The person also agrees to each write permission when they connect. Narrowing a policy takes effect on the app’s next call.
See and end connections
- Connections tab: every app a person has connected. Click Disconnect on a row, or Disconnect everything for this person.
- Apps tab: Revoke disconnects everyone using that app, and the app can’t be used again.
- Activity: each tool call shows as “Used a Foldr tool from a connected AI app”, naming the person and the app. Connecting and disconnecting show as Connected apps events. File contents are never recorded.
More detail
People who want to connect an assistant can follow Connect an AI assistant to Foldr.