3CX MCP Tools and Permission Levels

Introduction

Here follows an explanation of the AI functions supported by the 3CX MCP Server and related permission levels. This will allow you to manage AI client permissions, MCP connections, and the specific PBX features accessible to the AI.

AI Client Tool Approval Settings

These settings define how the AI client accesses individual tools, serving as the first gatekeeper before any request reaches the PBX.

  • Always allow: The client executes the tool immediately without intervention.
  • Needs approval: The client prompts for user confirmation before executing each request.
  • Deny: The client prevents the tool from running entirely.

These client-side settings do not grant additional 3CX rights, but it governs how (and if) a request is submitted to 3CX. The 3CX MCP Server still evaluates each request as the authenticated 3CX user.

3CX Permission Integration

The AI’s capabilities are strictly limited to the permissions of the 3CX user who authorized the connection. The MCP Server maps the AI request to this specific account, inheriting all associated role based access controls and capabilities.

  • Account-level restrictions such as department access, queue management, or DID settings are respected at all times.
  • If a specific 3CX user lacks the authority to modify data, the AI cannot perform those actions, regardless of the client-side configuration.
  • The Query tool is strictly limited to read-only operations to ensure database integrity.

User Roles and Tool Access

The list below shows the tools available through the 3CX MCP Server. What a user can see or do with them depends on the permissions of the 3CX account used for the connection.

Read-Only Tools

These tools let the AI view information from the PBX. They do not change PBX settings or affect calls.

User, contacts and directory

  • Find by email - Find a contact by email address.
  • Find extension - Find a contact by exact extension number.
  • List CRM contacts - Search contacts from an integrated CRM.
  • List phonebook - Search the available 3CX phonebooks.
  • List users - List PBX users and extensions.

Calls, recordings and voicemail

  • List active calls - Show calls that are currently active.
  • List recordings - List recordings available to the authenticated user.
  • List voicemails - List voicemail items available to the authenticated user.

Queues, departments and profiles

  • List department members - Show the members of a department.
  • List departments - Show the departments accessible to the authenticated user.
  • List profiles - Show the forwarding or presence profiles available to the current user.
  • List queue agents - Show the agents in a queue.
  • List queues - Show the queues that the current user can access or manage.

System and diagnostics

  • Get server time - Show the current PBX server time.
  • List event log - Search or list structured PBX event information.
  • List services - List PBX services and their current state.
  • Search logs - Search application logs using the available filters.

PBX inventory and database

  • Describe table - Return the schema of an accessible database table.
  • List DIDs - List the DIDs available on the PBX.
  • List IP blocklist - List entries in the IP blocklist.
  • List peers - List configured PBX peers.
  • List phone blacklist - List entries in the phone blacklist.
  • List tables - List database tables accessible to the current user.
  • List trunks - List configured SIP trunks.
  • Query - Run a read-only SQL SELECT query against accessible data.

Call flow tools

  • Get call flow app - Retrieve details for a call flow application.
  • Get call flow app files - Retrieve the files associated with a call flow application.
  • Get edit URL - Return an edit URL for a supported PBX object.
  • List call flow apps - List the call flow applications available on the PBX.

Write or Delete Tools

Write or delete tools can change call state, user status, routing data, blocklists, or call flow. It is very strongly recommended to keep these tools set to Needs approval or Blocked unless the workflow has been reviewed and the authenticated user is allowed to perform the action.

Call, queue and profile actions

  • Drop call - End a selected active call.
  • Select profile - Activate a forwarding or presence profile.
  • Set profile message - Set or clear the message for the active profile.
  • Set profile override - Apply a temporary profile override.
  • Set queue agent status - Log a queue agent in or out when the user has the required rights.
  • Set queue status - Log the current user in or out of queues.

PBX configuration actions

  • Add IP blocklist entry - Add an IP address to the PBX IP blocklist.
  • Add phone blacklist number - Add a number to the phone blacklist.
  • Assign DID - Assign a DID using the permissions available to the authenticated user.
  • Remove IP blocklist entry - Remove an IP address from the PBX IP blocklist.
  • Remove phone blacklist number - Remove a number from the phone blacklist.
  • Update call flow app script - Update the script used by a call flow application.

See Also

Last Updated
This document was last updated on 28 July 2026
https://www.3cx.com/docs/mcp-tools-permissions/