Hey guys, I haven't recorded in a little

bit, so I wanted to put out a quick

video this time on open web UI

permissions for both models and also MCP

servers. So if you are running this type

of platform in a semi-production

environment, you want to make sure that

you have proper arbback permissions and

restrictions and guardrail so on and so

forth set up so that you can block

unauthorized users to certain

capabilities. So, as you can see here, I

have test user one set up. Nothing

really configured yet. We're going to go

through that here. So, no model set up,

no MCP set up, and I'm going to show you

how to do that. So, if I jump back over

here, this is my admin login. I went to

admin settings and then models. You can

see here, this is just one example. If

you go over to access, you see it's set

up as private. You can also make it

public which makes it available to

everyone within the open web UI

deployment or you can also granularly

add permissions per user as I'm going to

do here. So I will add that one and then

I will also jump over to my external

tools a lot of which are MCP servers.

You can see I have quite a few here. I'm

going to go into this test group me one

just to demonstrate what this looks

like. This is a custom group me backend

that I have running in my Kubernetes

cluster. And you can see that the

authorization has to be passed per MCP

implementation. So once you import this

configuration, you do also have to pass

in the specific access token. So the way

this could work depending on how you

want to set it up, you run this backend

and it accepts any connection from

anyone using this tool, but the

authorization happens here. So you need

to actually provide this token per user.

So then the way this works is I come

here, I say add access, test user one. I

grant that, save it. I come back in

here, do a quick refresh, and then

you'll see in here that I should have

access to both this model that I

configured as well as the MCP tool. Of

course, it's not going to work because,

as you saw, it's just a blank tool at

this point. I didn't put any

configuration into it. But you could set

this up per user to have specific MCP

tools with that specific authentication

per user configured purely through open

web UI. So I hope this is helpful for

others that are building out MCP

implementations. Uh, of course, if you

write it yourself, you do have that

flexibility of passing the O in that

way. There are some other ways to do it

with MCP proxies. I'll probably make a

future video on that. But at least you

can see one way to secure and safeguard

your implementation of Open Web UI. Hope

it's helpful.