"Granting Filesystem Access Permissions for Kiro IDE on macOS" matching MCP tools:

• manage_connectionA

  mcp-serverA

  Create, list, test, or delete a workspace connection to an external data source. Two types are supported: "sftp" and "aws_s3". For sftp, create generates a keypair and returns the public key — it must be installed in the remote server's authorized_keys before test (or a trigger using this connection) will succeed. For aws_s3, create generates an ExternalId and returns a trustPolicy plus dpfPrincipalArn — the customer must create (or update) the IAM role at roleArn with that trust policy and a permissions policy granting the S3 access DPF needs, before test will succeed. Either type must pass test before it can be used in a trigger. For a first-time "pull files from this server/bucket on a schedule" request, prefer setup_scheduled_pull, which chains create + test + create-trigger for you.

  Connector

  Destructive

  OAuth

• list_missing_permissionsA

  Local MCPA

  Returns the macOS privacy (TCC) permissions Local MCP needs that are NOT granted yet, each with a one-click `open_url` that opens the exact System Settings → Privacy & Security pane. Read-only and passive (never prompts). Use it during setup or before a workflow to tell the user precisely which "Allow" clicks remain (Calendar, Contacts, Reminders, Automation for Mail/Messages/Notes/OmniFocus, Full Disk Access, Screen Recording, Accessibility) instead of failing mid-task. An installed app that is closed can't be checked and is listed under `unverified`. `all_granted: true` means nothing is left to do.

  ConnectorOAuth

• manage_report_accessA

  SEO GSC Wizard MCPA

  Grants or revokes client access to a saved shareable report. This is what makes a report openable at all: an ungranted report opens for nobody, including the account owner. After granting, the client opens the report URL, enters their email, and GSC Wizard emails them a login link. That self-serve sign-in only works once they hold a grant. Clients must already exist on the account: add them with create_report_client, find ids with list_report_clients. NOTE: unlike the web app's share dialog, this tool does NOT itself send a "report shared with you" notification. Either pass the recipient the report URL, or send the notification from Account > Shared Reports in GSC Wizard (https://tool.gscwizard.com/account/shared-reports), where each client has a Resend button. action "revoke" withdraws access. Granting is idempotent: a client who already had access stays granted and is reported as unchanged.

  Connector

  Destructive

  OAuth

• gluecron_create_repo_tokenA

  GluecronB

  Mint a fine-grained repository token (`gcft_…`) for ONE repository and return it once. It authenticates the REST API (/api/v2 and the GitHub-compatible /api/v3), git over HTTPS and the container registry (images under owner/repo, by contents) for that repository only. `permissions` sets none/read/write for contents, issues, pull_requests, statuses and actions (admin and settings are never grantable); `expires_in` is optional: omit it (or "never") for no expiration, or give seconds or "30m", "12h", "7d", "1y" (min 5 minutes, max 1 year). Effective access is always held to YOUR current access to the repo, re-checked on every use, and branch protection applies as it does to you. Needs 'repo' scope. Audit-logged. Returns {id, name, repository, permissions, expiresAt, tokenPrefix, token}.

  ConnectorNo auth

• authenticateA

  Mercado Financeiro BRA

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  Midway MCPA

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  Stone Pagamentos MCPA

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  CPlug (ConnectPlug)A

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  Santander MCPA

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  Uber Conta by Digio MCPA

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  RecargaPay MCPA

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  Clear MCPA

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  INPIB

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  Conta Azul MCPB

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  CNPJA

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  DataJud (CNJ)A

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  LibreLink Up (CGM)A

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  Nota FiscalA

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  Feegow ClinicD

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  Garmin Connect (treinos)A

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth

• authenticateA

  DietBoxB

  MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.

  ConnectorNo auth