Choose an Access Profile

An access profile controls which Essbase MCP tools a client can see and use. It helps limit the available actions to the level of access that a user or AI client actually needs.

Essbase provides the following access profiles:

viewer, which exposes read-only tools for working with Essbase.
analyst, which exposes the viewer tools, plus additional query and execution capabilities.
admin, which exposes all available Essbase tools (35), including those for management and configuration. Management tools take a generic payload (a JSON object/string forwarded to the underlying Essbase REST operation).

Access profile can be selected by adding a profile query parameter to the MCP endpoint. For example:

<base_url>/essbase/rest/v1/ess-mcp?profile=viewer

You can also apply the profile when listing tools:

<base_url>/essbase/rest/v1/ess-mcp/tools?profile=viewer

For a first connection, start with the viewer profile. This lets you confirm that authentication, connection, and tool discovery are working, without exposing tools that can change Essbase data or configuration.

The access profile limits which tools the MCP server presents to your AI client. It does not replace Essbase security. Every tool call is still checked against the permissions of the authenticated user. A client may be aware of a tool in its profile, but be unable to use it, if the signed-in user does not have the required Essbase privileges.