diff --git a/config/packages/security.yaml b/config/packages/security.yaml
index e7a44e0c..d9bf0400 100644
--- a/config/packages/security.yaml
+++ b/config/packages/security.yaml
@@ -73,3 +73,6 @@ security:
         - { path: "^/api", allow_if: 'is_granted("@api.access_api") and is_authenticated()' }
         # Restrict access to KICAD to users, which has API access permission
         - { path: "^/kicad-api", allow_if: 'is_granted("@api.access_api") and is_authenticated()' }
+
+        # Restrict MCP access to users, which has the MCP access permission
+        - { path: "^/mcp", allow_if: 'is_granted("@api.use_mcp") and is_authenticated()' }
diff --git a/config/permissions.yaml b/config/permissions.yaml
index 39e91b57..704da880 100644
--- a/config/permissions.yaml
+++ b/config/permissions.yaml
@@ -381,7 +381,12 @@ perms: # Here comes a list with all Permission names (they have a perm_[name] co
       access_api:
         label: "perm.api.access_api"
         apiTokenRole: ROLE_API_READ_ONLY
+      use_mcp:
+          label: "perm.api.use_mcp"
+          alsoSet: [ 'access_api' ]
+          apiTokenRole: ROLE_API_READ_ONLY
       manage_tokens:
         label: "perm.api.manage_tokens"
         alsoSet: ['access_api']
         apiTokenRole: ROLE_API_FULL
+
diff --git a/translations/messages.en.xlf b/translations/messages.en.xlf
index 4d59c51a..0f0bae0e 100644
--- a/translations/messages.en.xlf
+++ b/translations/messages.en.xlf
@@ -13793,5 +13793,11 @@ Buerklin-API Authentication server:
         <target>Warning: Changing values here can break the  info retrieval mechanism! You should use the "update from  info provider" functionality whenever possible.</target>
       </segment>
     </unit>
+    <unit id="bNrxe9i" name="perm.api.use_mcp">
+      <segment>
+        <source>perm.api.use_mcp</source>
+        <target>Use MCP tools (for AI agents)</target>
+      </segment>
+    </unit>
   </file>
 </xliff>