# IT approval kit Want to connect a sales tool to your AI assistant? If IT or RevOps has to say yes first, send them this. It shows what the connector can read and change, how it signs in, who has to approve it and how to turn it off. Online: https://mcpforgtm.com/toolkit/it-approval/ ## How to use it 1. Pick your tool below and open its one-pager. 2. Copy the request email, fill in the blanks and send it with the link. 3. IT checks the facts. Each fact links to its source: the tool vendor's docs, the AI assistant's docs or the StackMCP listing. Anything we couldn't confirm says Not confirmed. ## The request email Copy this email, fill in the parts in [brackets] and send it to IT, RevOps or the tool's admin. Each tool page has a version with that tool's facts already filled in. ```text Subject: Request: connect [tool] to [your AI assistant] for my sales work Hi [name], I'd like to connect [tool] to [your AI assistant] using [tool]'s official MCP connector. I want to use it for [task, for example call prep or pipeline review]. What I'm asking for: - Approval to connect [tool], and which sign-in you want me to use. - Any admin step [tool] needs before I can connect. How I'll use it: - I'll approve each action that creates, changes or sends something before it runs. - I'll disconnect it if you ask, or when I stop using it. The facts and their sources: https://mcpforgtm.com/toolkit/it-approval/ Thanks, [your name] ``` ## Checklist for IT IT usually asks these questions. Each tool page answers them in this order. - [ ] What data can the connector reach? - [ ] What can it read, and what can it change? - [ ] Which actions should wait for a person's OK? - [ ] How does it sign in: OAuth or an API key? - [ ] Does an admin have to approve or enable it first? - [ ] How do we turn it off? - [ ] Does it use credits or quota? _Each fact links to its source: the tool vendor's docs, the AI assistant's docs or the StackMCP listing. Anything without a source says Not confirmed. Vendors change their connectors, so confirm anything important on the linked page. We last checked the vendor quotes and the Claude help article on Oct 22, 2026, and the StackMCP listing facts on Oct 16, 2026._ ## HubSpot connector: IT approval one-pager HubSpot's MCP server can read and change data. An admin or IT has to act before anyone can connect it. This page covers what it can reach and change, how it signs in, who approves it and how to turn it off. Online: https://mcpforgtm.com/toolkit/it-approval/hubspot - Server URL: https://mcp.hubspot.com (Source: StackMCP listing, https://mcpforgtm.com/tools/hubspot) - Access: Read + write (Source: https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server) - Sign-in: OAuth 2.1 with PKCE (MCP connector) (Source: StackMCP listing, https://mcpforgtm.com/tools/hubspot) - Admin approval: Yes (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - Setup: Needs admin or IT (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - Credits: Not confirmed - Plan: Free (Source: https://www.hubspot.com/claude/connector) ### What data can it reach? HubSpot's docs list these tools for its MCP server: - CRM search/CRUD - activities - campaigns - marketing emails - conversations - pages/blog - AEO (Marketing Pro+) (Source: https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server) - In Claude, the connector can reach contacts, companies, deals, tickets, custom objects, marketing emails, blogs, users, line items, quotes, invoices, orders, carts, products, subscriptions and segments, plus how they link together. (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - It can also reach engagement history: emails, calls, meetings, tasks and notes. (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - Each person only sees the CRM data their HubSpot permissions allow. (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) ### What can it read, and what can it change? Read + write. Things it can do in your HubSpot account (Source: https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server): - creates and edits CRM records (contacts, companies, deals, tickets, etc.) - logs activities (calls, emails, meetings, notes, tasks) - creates, edits and publishes landing pages, website pages and blog posts - creates and updates campaigns - creates and updates marketing email drafts - creates and manages pipelines - creates custom properties - creates segments and adds/removes records - creates quotes (beta) - creates AEO tracked prompts and starts content generation ### Which actions should wait for a person's OK? Have a person approve each change listed above before it runs. Every StackMCP recipe follows this rule: read freely, but create, change or send only after you approve it. - HubSpot recommends that you set Write tools to Needs Approval in the connector's tool settings in Claude. Then it asks before it makes any update. (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - If you set it to Always allow, it can make edits without asking. (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) ### How does it sign in? Sign-in method (from the StackMCP listing): OAuth 2.1 with PKCE (MCP connector) (Source: StackMCP listing, https://mcpforgtm.com/tools/hubspot) ### Does an admin need to approve it? What HubSpot's docs confirm about admin controls: - An admin must approve or enable the connection: Yes (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - Scopes or permissions can limit what it reaches: Yes (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - Individual tools can be turned off: Not confirmed - MCP activity shows in an audit log: Yes (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - Super Admins and users with App Marketplace Access permissions can connect without prior app approval. (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - Everyone else needs a Super Admin to approve the connector first. During approval, the Super Admin picks which data it can reach and who can install it. (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - In HubSpot audit logs, Super Admins can see who connected and when, plus every create and update made through the connector. (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) ### How do we turn it off? #### In HubSpot The HubSpot docs we checked only explain how to disconnect in the AI assistant (below). To remove the connector in HubSpot itself, ask your HubSpot admin. #### In the AI assistant - HubSpot's steps to disconnect in Claude: select your profile icon, then Settings, then Connectors, then HubSpot, then Disconnect. (Source: https://knowledge.hubspot.com/integrations/set-up-and-use-the-hubspot-connector-for-claude) - For other assistants, check that assistant's settings or ask your admin. ### Does it use credits or quota? Not confirmed ### Send this to IT Copy this, fill in the parts in [brackets] and send it. ```text Subject: Request: connect HubSpot to [your AI assistant] for my sales work Hi [name], I'd like to connect HubSpot to [your AI assistant] using HubSpot's official MCP connector. I want to use it for [task, for example call prep or pipeline review]. What I'm asking for: - Approval to connect HubSpot. It signs in with OAuth. I'd only see the CRM data my HubSpot permissions allow. - Any admin step HubSpot needs before I can connect. How I'll use it: - I'll approve each action that creates, changes or sends something before it runs. - I'll disconnect it if you ask, or when I stop using it. Quick facts: - Access: Read + write - Sign-in: OAuth 2.1 with PKCE (MCP connector) - Setup: Needs admin or IT - Credits: Not confirmed The facts and their sources: https://mcpforgtm.com/toolkit/it-approval/hubspot Thanks, [your name] ``` _Each fact links to its source: the tool vendor's docs, the AI assistant's docs or the StackMCP listing. Anything without a source says Not confirmed. Vendors change their connectors, so confirm anything important on the linked page. We last checked the quotes on this page (vendor docs and the Claude help article) on Oct 22, 2026, and the StackMCP listing facts on Oct 16, 2026._ ## Salesforce connector: IT approval one-pager Salesforce's MCP server can read and change data. An admin or IT has to act before anyone can connect it. This page covers what it can reach and change, how it signs in, who approves it and how to turn it off. Online: https://mcpforgtm.com/toolkit/it-approval/salesforce - Server URL (full access server, Source: https://github.com/forcedotcom/mcp-hosted/wiki/FAQ): https://api.salesforce.com/platform/mcp/v1/platform/sobject-all (Source: StackMCP listing, https://mcpforgtm.com/tools/salesforce) - Read-only server: https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Connecting-Your-MCP-Client, https://github.com/forcedotcom/mcp-hosted/wiki/FAQ) - Production org URL pattern. Sandbox and My Domain orgs use a different URL. - Access: Read + write (Source: https://github.com/forcedotcom/mcp-hosted/wiki/FAQ) - Sign-in: OAuth 2.0 authorization code flow with PKCE via an admin-created External Client App (scopes mcp_api + refresh_token); no DCR, no client-credentials (Source: StackMCP listing, https://mcpforgtm.com/tools/salesforce) - Admin approval: Yes (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Confirming-Availability) - Setup: Needs admin or IT (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Client-Tips-and-Troubleshooting) - Credits: Every call uses quota (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Known-Limitations) - Plan: Enterprise Edition or above (Developer Edition also works) (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Confirming-Availability) ### What data can it reach? Salesforce's docs list these tools for its MCP server: - SOQL query (soqlQuery) and SOSL search (find) - object schema (describeGlobal, getObjectSchema) - related and recent records - record create/update/delete (platform/sobject-all) - custom tools from Apex, Flows and Named Queries - prompt templates (sobject-all) (Source: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/hosted-mcp-servers-overview.html) - It works as the signed-in person. It can only use objects that person can read, create, update or delete. (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) - Fields the person can't see are hidden from it. Fields they can't edit are read-only to it. (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) - It follows the same sharing rules as the person. Private records stay private. (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) ### What can it read, and what can it change? Read + write. Things it can do in your Salesforce account (Source: https://github.com/forcedotcom/mcp-hosted/wiki/FAQ): - creates, updates and deletes Salesforce records (platform/sobject-all server) - creates opportunities - runs admin-defined custom actions (Apex invocable actions, Flows) ### Which actions should wait for a person's OK? Have a person approve each change listed above before it runs. Every StackMCP recipe follows this rule: read freely, but create, change or send only after you approve it. - Salesforce says most organizations should start with its read-only server, platform/sobject-reads. That server has no tool that can create, update or delete a record. (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) Also check before you run anything that spends credits or quota (a usage limit). Credits or quota for this connector: Every call uses quota. ### How does it sign in? Sign-in method (from the StackMCP listing): OAuth 2.0 authorization code flow with PKCE via an admin-created External Client App (scopes mcp_api + refresh_token); no DCR, no client-credentials (Source: StackMCP listing, https://mcpforgtm.com/tools/salesforce) - Every session belongs to one person who signed in with their own login. (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) - There are no service accounts. (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) ### Does an admin need to approve it? What Salesforce's docs confirm about admin controls: - An admin must approve or enable the connection: Yes (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Confirming-Availability) - Scopes or permissions can limit what it reaches: Yes (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) - Individual tools can be turned off: Yes (Source: https://github.com/forcedotcom/mcp-hosted/wiki/FAQ) - MCP activity shows in an audit log: Not confirmed - Every MCP server is off by default. An admin has to turn each one on in Setup, then API Catalog, then MCP Servers. (Source: https://github.com/forcedotcom/mcp-hosted/wiki/FAQ) - Admins can link each External Client App to profiles and permission sets. That controls who can sign in through which assistant. (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) - When it updates a record, Salesforce shows the signed-in person as the editor. (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Security-and-Permissions) ### How do we turn it off? #### In Salesforce The Salesforce docs we checked don't say how to revoke MCP access. Ask your Salesforce admin. #### In the AI assistant - In Claude, you can revoke access at any time. Disconnect the connector in Claude's settings, or in the tool's own security settings. (Source: https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp) - For other assistants, check that assistant's settings or ask your admin. ### Does it use credits or quota? Every call uses quota. No paid credits; every tool call counts against the org's daily Salesforce API request quota (one or more API calls per tool). (Source: https://github.com/forcedotcom/mcp-hosted/wiki/Known-Limitations) ### Send this to IT Copy this, fill in the parts in [brackets] and send it. ```text Subject: Request: connect Salesforce to [your AI assistant] for my sales work Hi [name], I'd like to connect Salesforce to [your AI assistant] using Salesforce's official MCP connector. I want to use it for [task, for example call prep or pipeline review]. What I'm asking for: - Approval to connect Salesforce with my own Salesforce login. It can only use the objects and records my Salesforce permissions allow. - Any admin step Salesforce needs before I can connect. How I'll use it: - I'll approve each action that creates, changes or sends something before it runs. - I'll disconnect it if you ask, or when I stop using it. Quick facts: - Access: Read + write - Sign-in: OAuth 2.0 authorization code flow with PKCE via an admin-created External Client App (scopes mcp_api + refresh_token); no DCR, no client-credentials - Setup: Needs admin or IT - Credits: Every call uses quota The facts and their sources: https://mcpforgtm.com/toolkit/it-approval/salesforce Thanks, [your name] ``` _Each fact links to its source: the tool vendor's docs, the AI assistant's docs or the StackMCP listing. Anything without a source says Not confirmed. Vendors change their connectors, so confirm anything important on the linked page. We last checked the quotes on this page (vendor docs and the Claude help article) on Oct 22, 2026, and the StackMCP listing facts on Oct 16, 2026._ ## Gong connector: IT approval one-pager Gong calls its MCP server read-only. The setup also lists an mcp:write scope, so confirm scopes with your admin. An admin or IT has to act before anyone can connect it. This page covers what it can reach and change, how it signs in, who approves it and how to turn it off. Online: https://mcpforgtm.com/toolkit/it-approval/gong - Server URL: https://mcp.gong.io/mcp (Source: StackMCP listing, https://mcpforgtm.com/tools/gong) - Access: Read only (Source: https://help.gong.io/docs/about-gong-mcp-server) Gong calls it read-only. The setup also lists an mcp:write scope, so confirm scopes with your admin. (Source: https://help.gong.io/docs/about-gong-mcp-server, https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server) - Sign-in: OAuth 2.0 (admin-registered integration: automatic registration or manual client ID/secret; scopes mcp:read / mcp:write) (Source: StackMCP listing, https://mcpforgtm.com/tools/gong) - Admin approval: Yes (Source: https://help.gong.io/docs/about-gong-mcp-server) - Setup: Needs admin or IT (Source: https://help.gong.io/docs/about-gong-mcp-server) - Credits: Every call uses credits (Source: https://help.gong.io/docs/how-mcp-server-tools-and-apis-consume-credits) - Plan: Any Gong plan (paid Gong seat required; Gong credits needed) (Source: https://help.gong.io/docs/about-gong-mcp-server) ### What data can it reach? Gong's docs list these tools for its MCP server: - ask_account (account Q&A) - ask_deal (deal Q&A) - generate_brief (account/deal/contact briefs) (Source: https://help.gong.io/docs/about-gong-mcp-server) - Each tool looks at calls and emails from a set time range and returns AI-written insights. (Source: https://help.gong.io/docs/about-gong-mcp-server) - It doesn't return raw data like call transcripts, message bodies or activity lists. (Source: https://help.gong.io/docs/about-gong-mcp-server) - Private calls are left out of all results. (Source: https://help.gong.io/docs/about-gong-mcp-server) - With personal access, each person only gets their own data. (Source: https://help.gong.io/docs/about-gong-mcp-server) - With shared access, one token gives everyone org-wide data. (Source: https://help.gong.io/docs/about-gong-mcp-server) ### What can it read, and what can it change? Read only. The documented tools only read data. (Source: https://help.gong.io/docs/about-gong-mcp-server) Gong calls it read-only. The setup also lists an mcp:write scope, so confirm scopes with your admin. (Source: https://help.gong.io/docs/about-gong-mcp-server, https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server) ### Which actions should wait for a person's OK? Its documented tools only read data. Because the setup also lists a write scope, confirm the scopes with your admin, and approve anything that would create, change or send before it runs. - Gong says the server is read-only. It doesn't create, update or delete anything in Gong or the CRM. (Source: https://help.gong.io/docs/about-gong-mcp-server) - Gong's sign-in setup also offers an mcp:write scope. The Gong docs we checked don't say what it allows. Ask your Gong admin which scopes your integration grants. (Source: https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server) Also check before you run anything that spends credits or quota (a usage limit). Credits or quota for this connector: Every call uses credits. ### How does it sign in? Sign-in method (from the StackMCP listing): OAuth 2.0 (admin-registered integration: automatic registration or manual client ID/secret; scopes mcp:read / mcp:write) (Source: StackMCP listing, https://mcpforgtm.com/tools/gong) - It signs in with OAuth. (Source: https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server) - Gong's sign-in setup lists two scopes: mcp:read and mcp:write. If the scope field is empty, Gong grants the scopes set on the integration. (Source: https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server) - With a manual integration, Gong issues a client ID and secret. Only the assistant that holds them can connect. (Source: https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server) ### Does an admin need to approve it? What Gong's docs confirm about admin controls: - An admin must approve or enable the connection: Yes (Source: https://help.gong.io/docs/about-gong-mcp-server) - Scopes or permissions can limit what it reaches: Yes (Source: https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server) - Individual tools can be turned off: Not confirmed - MCP activity shows in an audit log: Not confirmed - A Gong tech admin has to register the MCP integration in Gong before anyone can connect. (Source: https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server) - Gong suggests personal access for chat assistants like Claude and ChatGPT, so people only reach their own Gong data. (Source: https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server) - The admin picks Personal or Shared access when registering the integration. It can't be changed later. (Source: https://help.gong.io/docs/create-an-integration-to-connect-to-the-mcp-server, https://help.gong.io/docs/manage-mcp-server-integrations) ### How do we turn it off? #### In Gong - A tech admin can disable the integration. That revokes all its access tokens and signs everyone out. (Source: https://help.gong.io/docs/manage-mcp-server-integrations) - Deleting the integration also revokes all its tokens. You can't undo it. (Source: https://help.gong.io/docs/manage-mcp-server-integrations) #### In the AI assistant - In Claude, you can revoke access at any time. Disconnect the connector in Claude's settings, or in the tool's own security settings. (Source: https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp) - For other assistants, check that assistant's settings or ask your admin. ### Does it use credits or quota? Every call uses credits. All three tools (ask_account, ask_deal, generate_brief) consume Gong credits based on the volume of calls and emails analyzed; briefs cost more per open-ended section. Same consumption as the equivalent API requests. (Source: https://help.gong.io/docs/how-mcp-server-tools-and-apis-consume-credits) ### Send this to IT Copy this, fill in the parts in [brackets] and send it. ```text Subject: Request: connect Gong to [your AI assistant] for my sales work Hi [name], I'd like to connect Gong to [your AI assistant] using Gong's official MCP connector. I want to use it for [task, for example call prep or pipeline review]. What I'm asking for: - Approval to connect Gong through an MCP integration that a Gong tech admin registers. Please set it to Personal access, which Gong suggests for AI assistants, so I'd only reach my own Gong data. Gong says this setting can't be changed after the integration is created. - Any admin step Gong needs before I can connect. How I'll use it: - I'll approve each action that creates, changes or sends something before it runs. - I'll disconnect it if you ask, or when I stop using it. Quick facts: - Access: Read only (Gong calls it read-only. The setup also lists an mcp:write scope, so confirm scopes with your admin.) - Sign-in: OAuth 2.0 (admin-registered integration: automatic registration or manual client ID/secret; scopes mcp:read / mcp:write) - Setup: Needs admin or IT - Credits: Every call uses credits The facts and their sources: https://mcpforgtm.com/toolkit/it-approval/gong Thanks, [your name] ``` _Each fact links to its source: the tool vendor's docs, the AI assistant's docs or the StackMCP listing. Anything without a source says Not confirmed. Vendors change their connectors, so confirm anything important on the linked page. We last checked the quotes on this page (vendor docs and the Claude help article) on Oct 22, 2026, and the StackMCP listing facts on Oct 16, 2026._ ## Apollo connector: IT approval one-pager Apollo's MCP server can read and change data. The vendor's setup notes don't mention an admin step. This page covers what it can reach and change, how it signs in, who approves it and how to turn it off. Online: https://mcpforgtm.com/toolkit/it-approval/apollo - Server URL: https://mcp.apollo.io/mcp (Source: StackMCP listing, https://mcpforgtm.com/tools/apollo) - Access: Read + write (Source: https://docs.apollo.io/docs/apollo-mcp) - Sign-in: OAuth 2.0 (master API key / X-Api-Key for headless) (Source: StackMCP listing, https://mcpforgtm.com/tools/apollo) - Admin approval: Not confirmed - Setup: Self-serve (Source: https://docs.apollo.io/docs/apollo-mcp) - Credits: Some tools use credits (Source: https://docs.apollo.io/docs/apollo-mcp) - Plan: Free (Source: https://knowledge.apollo.io/hc/en-us/articles/45119679436557-Use-Apollo-MCP-with-AI-Tools-to-Run-Your-GTM-Workflow) ### What data can it reach? Apollo's docs list these tools for its MCP server: - people/company search - enrichment - contacts & accounts CRUD - sequences - one-off email - lists - tasks - analytics (Source: https://docs.apollo.io/docs/apollo-mcp) - It works within your Apollo permissions, plan and credits. The assistant can only do what your Apollo account allows. (Source: https://docs.apollo.io/docs/apollo-mcp) ### What can it read, and what can it change? Read + write. Things it can do in your Apollo account (Source: https://docs.apollo.io/docs/apollo-mcp): - creates and updates contacts and accounts - creates deals - adds and removes contacts in sequences (enrollment) - creates and updates sequences - sends one-off emails - creates and updates lists and adds/removes records - creates, completes and skips tasks - creates and applies labels - creates custom objects - connects data sources and imports records - purchases sending domains and email accounts ### Which actions should wait for a person's OK? Have a person approve each change or purchase listed above before it runs. Every StackMCP recipe follows this rule: read freely, but create, change, send or buy only after you approve it. - It can buy sending domains and email accounts for cold email. Have a person approve any purchase before it runs. (Source: https://docs.apollo.io/docs/apollo-mcp) Also check before you run anything that spends credits or quota (a usage limit). Credits or quota for this connector: Some tools use credits. ### How does it sign in? Sign-in method (from the StackMCP listing): OAuth 2.0 (master API key / X-Api-Key for headless) (Source: StackMCP listing, https://mcpforgtm.com/tools/apollo) - With OAuth, the assistant can only reach the data and actions of the Apollo user who connected it. (Source: https://docs.apollo.io/docs/apollo-mcp) - OAuth needs a browser. Clients with no browser, like a server, cron job or CI pipeline, use an Apollo API key instead. It has to be a master key. (Source: https://docs.apollo.io/docs/apollo-mcp) - Apollo says to treat a master key like a password: anyone who holds it can take any API action the workspace allows. (Source: https://docs.apollo.io/docs/apollo-mcp) - An API key isn't tied to the person who made it. Requests made with it act as the workspace's longest-standing active admin. (Source: https://docs.apollo.io/docs/apollo-mcp) ### Does an admin need to approve it? What Apollo's docs confirm about admin controls: - An admin must approve or enable the connection: Not confirmed - Scopes or permissions can limit what it reaches: Yes (Source: https://knowledge.apollo.io/hc/en-us/articles/43827318678541-Integrate-Apollo-with-Claude) - Individual tools can be turned off: Not confirmed - MCP activity shows in an audit log: Not confirmed ### How do we turn it off? #### In Apollo - To revoke OAuth access, go to the connected app or your account settings. To revoke an API key, regenerate or delete it in Apollo's developer dashboard. (Source: https://docs.apollo.io/docs/apollo-mcp) #### In the AI assistant - In Claude, you can revoke access at any time. Disconnect the connector in Claude's settings, or in the tool's own security settings. (Source: https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp) - For other assistants, check that assistant's settings or ask your admin. ### Does it use credits or quota? Some tools use credits. Company search, company enrichment (single and bulk), company job postings, and people enrichment (single and bulk) use credits; people/contact search, CRM, sequence, email, task and analytics actions do not. Get conversation insights uses credits only if the conversation has AI insights. (Source: https://docs.apollo.io/docs/apollo-mcp) ### Send this to IT Copy this, fill in the parts in [brackets] and send it. ```text Subject: Request: connect Apollo to [your AI assistant] for my sales work Hi [name], I'd like to connect Apollo to [your AI assistant] using Apollo's official MCP connector. I want to use it for [task, for example call prep or pipeline review]. What I'm asking for: - Approval to connect Apollo with OAuth as my own Apollo user, so it can only do what my Apollo user can do. I'm not asking for an API key, because Apollo's API key acts as the workspace's longest-standing active admin. - Any admin step Apollo needs before I can connect. How I'll use it: - I'll approve each action that creates, changes, sends or buys something before it runs. - I'll disconnect it if you ask, or when I stop using it. Quick facts: - Access: Read + write - Sign-in: OAuth 2.0 (master API key / X-Api-Key for headless) - Setup: Self-serve - Credits: Some tools use credits The facts and their sources: https://mcpforgtm.com/toolkit/it-approval/apollo Thanks, [your name] ``` _Each fact links to its source: the tool vendor's docs, the AI assistant's docs or the StackMCP listing. Anything without a source says Not confirmed. Vendors change their connectors, so confirm anything important on the linked page. We last checked the quotes on this page (vendor docs and the Claude help article) on Oct 22, 2026, and the StackMCP listing facts on Oct 16, 2026._ ## Slack connector: IT approval one-pager Slack's MCP server can read and change data. An admin or IT has to act before anyone can connect it. This page covers what it can reach and change, how it signs in, who approves it and how to turn it off. Online: https://mcpforgtm.com/toolkit/it-approval/slack - Server URL: https://mcp.slack.com/mcp (Source: StackMCP listing, https://mcpforgtm.com/tools/slack) - Access: Read + write (Source: https://docs.slack.dev/ai/slack-mcp-server) - Sign-in: Confidential OAuth (registered Slack app) (Source: StackMCP listing, https://mcpforgtm.com/tools/slack) - Admin approval: Yes (Source: https://docs.slack.dev/ai/slack-mcp-server) - Setup: Needs admin or IT (Source: https://docs.slack.dev/ai/slack-mcp-server/connect-to-claude) - Credits: Not confirmed - Plan: Not confirmed ### What data can it reach? Slack's docs list these tools for its MCP server: - search messages/files/users/channels - send/schedule messages - canvases - lists - file upload - reactions (Source: https://docs.slack.dev/ai/slack-mcp-server) - It can search messages and files and read what's in them. (Source: https://docs.slack.dev/ai/slack-mcp-server) - It can search public and private channels. (Source: https://docs.slack.dev/ai/slack-mcp-server) - It can read full user profiles, including custom fields and statuses. (Source: https://docs.slack.dev/ai/slack-mcp-server) - Each tool needs specific OAuth scopes (permissions) on the person's user token. Slack lists the scopes for each tool. (Source: https://docs.slack.dev/ai/slack-mcp-server) ### What can it read, and what can it change? Read + write. Things it can do in your Slack account (Source: https://docs.slack.dev/ai/slack-mcp-server): - sends and schedules messages - creates channels and conversations - adds emoji reactions - creates and updates canvases - uploads files - creates and updates lists and list records ### Which actions should wait for a person's OK? Have a person approve each change listed above before it runs. Every StackMCP recipe follows this rule: read freely, but create, change or send only after you approve it. ### How does it sign in? Sign-in method (from the StackMCP listing): Confidential OAuth (registered Slack app) (Source: StackMCP listing, https://mcpforgtm.com/tools/slack) - Each person goes through Slack's OAuth consent screen and authorizes the app. (Source: https://docs.slack.dev/ai/slack-mcp-server) ### Does an admin need to approve it? What Slack's docs confirm about admin controls: - An admin must approve or enable the connection: Yes (Source: https://docs.slack.dev/ai/slack-mcp-server) - Scopes or permissions can limit what it reaches: Yes (Source: https://docs.slack.dev/ai/slack-mcp-server) - Individual tools can be turned off: Not confirmed - MCP activity shows in an audit log: Yes (Source: https://docs.slack.dev/ai/slack-mcp-server) - Workspace admins can approve and manage all MCP client integrations. (Source: https://docs.slack.dev/ai/slack-mcp-server) - It uses Slack's standard app approval process. (Source: https://docs.slack.dev/ai/slack-mcp-server) - Slack's audit logs record MCP tool calls, for example when an AI app reads a channel or sends a message for a person. (Source: https://docs.slack.dev/ai/slack-mcp-server, https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/) ### How do we turn it off? #### In Slack - These steps come from Slack's general help on removing apps, not from MCP-specific help. To revoke one person's authorization, go to Authorizations, find Authorized members, click See all, then click Revoke. The same article explains how to remove the app from the workspace. (Source: https://slack.com/help/articles/360003125231-Remove-apps-and-custom-integrations-from-your-workspace) - The same article says that if app approval is on, only Workspace Owners and app managers can remove apps. (Source: https://slack.com/help/articles/360003125231-Remove-apps-and-custom-integrations-from-your-workspace) #### In the AI assistant - In Claude, you can revoke access at any time. Disconnect the connector in Claude's settings, or in the tool's own security settings. (Source: https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp) - For other assistants, check that assistant's settings or ask your admin. ### Does it use credits or quota? Not confirmed ### Send this to IT Copy this, fill in the parts in [brackets] and send it. ```text Subject: Request: connect Slack to [your AI assistant] for my sales work Hi [name], I'd like to connect Slack to [your AI assistant] using Slack's official MCP connector. I want to use it for [task, for example call prep or pipeline review]. What I'm asking for: - Approval for the app through Slack's standard app approval. Then I can authorize it for my own account on Slack's OAuth consent screen. - Any admin step Slack needs before I can connect. How I'll use it: - I'll approve each action that creates, changes or sends something before it runs. - I'll disconnect it if you ask, or when I stop using it. Quick facts: - Access: Read + write - Sign-in: Confidential OAuth (registered Slack app) - Setup: Needs admin or IT - Credits: Not confirmed The facts and their sources: https://mcpforgtm.com/toolkit/it-approval/slack Thanks, [your name] ``` _Each fact links to its source: the tool vendor's docs, the AI assistant's docs or the StackMCP listing. Anything without a source says Not confirmed. Vendors change their connectors, so confirm anything important on the linked page. We last checked the quotes on this page (vendor docs and the Claude help article) on Oct 22, 2026, and the StackMCP listing facts on Oct 16, 2026._