MCP acts as the signed-in Taskavel user. It can access projects where that user is an owner or member; it does not bypass project membership.
For an OAuth client, open Account Settings → AI Integration (MCP) and check the connected client list. Revoke a client there when it should no longer have access, then reconnect it. For a CLI client, create a new personal access token if the old token is unavailable or revoked; the token is shown once when created.
Individual tools enforce roles. For example, guests can watch a task but cannot comment or upload attachments; inviting or removing members requires owner or admin access. Read the generated tool page for the tool’s required input and safety level.