MCP Access

What it does

Connects Claude Desktop to this panel. Once it is set up you can ask Claude, in plain words, to do panel work for you - “show me today’s pending withdrawals over 5,000”, “find the player with phone 0812…”, “answer the chat from player bob88” - and Claude does it through the panel.

Claude acts as you. It can see and do exactly what your account can see and do in the panel, and nothing more. If your role cannot approve withdrawals, neither can Claude.

Where to find it

Security & Access -> MCP Access

You need the MCP Access permission on your role. The owner always has it and can grant it to staff roles in Security & Access -> Roles.

Set it up

1. Install Claude Desktop on your computer and sign in.
2. On the MCP Access page, click Download extension and open the downloaded legion-agent.mcpb file. Claude Desktop installs it. If Claude Desktop still lists an older extension under another name, remove it under Extensions.
3. Click Create MCP key, give it a name (for example the computer it is for) and copy the key. It is shown only once.
4. In Claude Desktop, open the extension’s settings and paste the key. The API URL is already filled in.

Claude Desktop calls the panel from your computer, so it works only from an IP on your allowlist, the same as the panel itself.

Check that it works

1. In Claude Desktop, start a new chat and ask: “Using the Legion agent panel, show me today’s dashboard figures.”
2. Claude should say it is using the Legion Agent Panel tools, then answer with your panel’s own figures. Compare them with the Dashboard page.
3. On the MCP Access page, the key’s Last used time is now filled in - that is the panel confirming the key reached it.

If Claude says it has no Legion tools, turn the extension on in Claude Desktop’s settings under Extensions. If it reports an error code, see If something goes wrong below.

Using it safely

• Claude asks before every change. Reading is allowed straight away; anything that changes data (approving, rejecting, adjusting a balance, sending a chat message) shows you what it is about to do and waits for your OK. Read each one before you approve it, especially anything that moves money. When Claude Desktop asks to use Change agent panel data, choose Allow once - never Allow always, which would let changes through without asking.
• A key is as powerful as your login. Never share it or paste it anywhere else. Make one key per computer, and revoke it if the computer is lost or you stop using it.
• Every change is recorded under your name in the platform audit log, marked with the key it came through. The “Last used” column on the MCP Access page shows when each key was last active.

What a key can never do

Whatever your permissions, a key cannot create or revoke keys, change a password, create staff accounts, reset a staff password, change the IP allowlist (it can still read it), reveal or change payment gateway credentials, change the payout gate or auto withdraw settings, change the cashback or rebate policy, maker-checker, the first deposit referral bonus or the referral rank reward settings, change the fraud rules, remove a bank account from the blacklist, reset a player’s PIN and authenticator, change the player PIN and authenticator settings, or set a domain’s head script, body script or Google Tag Manager (a key can still change the other domain settings your role allows). Those need you in the panel. The one exception: a key made by a Platform staff account (shown with the Platform badge) can change the cashback and rebate policy, maker-checker, the first deposit referral bonus and the referral rank reward settings.

A key approves a withdrawal or a manual deposit only when the payout gate passes it. A key that resets a player’s password, unlocks or reactivates a player, changes a player’s name or phone, or adds or edits a payout bank also needs a code texted to the player’s registered phone: Claude asks for one, and the player reads it to you.

Managing keys

• Staff see and revoke their own keys. The owner sees every key on the account and can revoke any of them.
• A key stops working at once when it is revoked or expires, when its creator is disabled, or when their role loses the MCP Access permission. Removing other permissions from the role narrows what the key can do straight away.

If something goes wrong

What Claude reports	What it means
invalid_api_key (401)	The key is wrong, revoked or expired, or its creator was disabled. Create a new key.
forbidden_permission, forbidden_role, forbidden or owner_only (403)	Your role does not allow that action, or no longer has MCP Access.
forbidden_for_api_key (403)	That action is panel-only (see above). Do it in the panel.
forbidden_gate_not_passed (403)	The payout gate held that withdrawal or manual deposit, so a key cannot approve it. Open the payout gate column in the queue to see which checks did not pass; approve it yourself if you are satisfied.
gate_unavailable (503)	The payout gate could not run its checks just now. Try again in a moment.
takeover_otp_required or takeover_otp_invalid (403)	That change needs a fresh code from the player’s registered phone, and none was given or it was wrong, used or expired. Ask Claude to send a new code. The code is texted on your site’s SMS OTP account, so without one these changes are panel-only. If Claude cannot pass the code at all, download the extension again from the MCP Access page.
otp_not_configured (409)	Your site has no SMS OTP account, so no code was sent. Make the change in the panel.
rate_limited (429)	Too many calls in a minute. Wait a moment and try again.
Cannot connect	Check you are on an allowed IP, and that the API URL in the extension settings matches the one on the MCP Access page.