Skip to main content
Activation required. AI access management must be enabled for your tenant before you can use it. To get started, contact the C1 support team for a walkthrough.
C1 can govern Granola — an AI meeting-notes app — access two ways. Both let your AI clients read from Granola through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog:
  • Granola MCP — listed as plain Granola in your catalog. C1 registers Granola’s own hosted MCP server (mcp.granola.ai) as a downstream server C1 governs. Authentication is always per-user OAuth using dynamic client registration (DCR) — Granola’s hosted MCP server doesn’t support a bearer token or API key, so there’s no integration to create in Granola first. Tool calls run with the connected user’s own Granola access, scoped to their active workspace.
  • Granola API — C1 hosts its own MCP server that translates Granola’s REST API into tools. Authentication is a single shared bearer token (a Granola API key), so every tool call reaches Granola as one identity.
Use the native Granola MCP option (listed as plain Granola in your catalog) if per-user OAuth is acceptable for your tenant and you want each user’s tool calls attributed to them individually. Use Granola API if you need a single shared credential instead.
C1 registers as a client of Granola’s own hosted MCP server (Granola MCP) rather than translating Granola’s REST API itself. Your users’ AI clients still only ever see C1-governed MCP tools, but C1 proxies each tool call straight through to mcp.granola.ai under the connected user’s authorized session, then returns the result. The tools available are exactly the ones Granola’s own MCP server exposes — C1 doesn’t reshape or add to them.

​
Before you begin

  • AI access management must be enabled for your tenant. See Enable AI access management.
  • Nothing to create in Granola ahead of time. This option only supports per-user OAuth with dynamic client registration — Granola’s hosted MCP server doesn’t offer a bearer token or API key mode, so there’s no client ID, secret, or integration to register. Each user just needs a Granola account with access to the workspace whose notes they want tools to reach.
In your MCP server catalog, this option is listed as Granola — distinct from the Granola API entry, which connects through C1’s own MCP server. If you don’t see either, contact the C1 support team to enable it for your tenant.

​
Set up per-user OAuth

Per-user OAuth with dynamic client registration (DCR) is the only authentication method this option supports — there’s no bearer token or API key fallback. Each user authorizes individually through their browser, signing in with the Granola account tied to their workspace, and C1 registers itself with Granola’s authorization server automatically, so there’s no app to create in Granola first (see Granola’s Granola MCP documentation).
1
Follow Register an MCP server and select Granola from the catalog.
2
When you configure authentication, choose OAuth2 — per-user passthrough and enable Use dynamic client registration. There’s no client ID or secret to enter.
3
Save your changes. The first time a user calls a Granola tool from their AI client, they’re redirected to sign in with their Granola account (if they aren’t already) and approve the connection, then returned to C1.

​
What access is granted

Unlike the Granola API option, there are no separate capability toggles to configure. Once a user authorizes, tool calls run with that user’s own Granola access, scoped to their active workspace and the note categories (personal and shared/public) they can already reach in Granola (Granola MCP).

​
How Granola MCP credentials are shared

This option only supports per-user OAuth — there’s no shared, service-account, or bearer-token mode. Every tool call runs under the calling user’s own Granola identity. C1 still attributes each call to the individual user in the AI tool usage audit log.

​
Discover and govern tools

After you register the server, C1 runs tool discovery against Granola’s MCP server. Discovered tools appear on the server’s Tools tab and include Granola’s meeting-notes search, folder browsing, meeting listing, and note-reading tools.Each tool starts as either Pending review or automatically Approved, depending on the option chosen when the server was set up or your tenant’s default tool settings in AI > MCP > Settings. See Require tool approval and Default tool classification.Before anyone can call a Granola tool, it must be approved, added to a toolset, and bound to an access profile. Continue to Govern tools and toolsets to set this up.
Tool discovery runs even if authentication isn’t complete yet, so seeing discovered tools doesn’t confirm a user has authorized. You confirm access when an approved user successfully calls a Granola tool from their AI client.

​
Manage access to Granola MCP

Because this option uses per-user OAuth, there’s no shared secret in C1 to rotate. Granola’s own published documentation (Granola MCP) doesn’t describe a centralized, self-service page in Granola for listing or revoking individual MCP connections — the documented way to disconnect is from the connected AI client itself (for example, in Claude, opening the Granola connector’s settings and choosing to disconnect it, then reconnecting to re-authorize). If your tenant needs a connection revoked and you can’t do it from the AI client side, contact Granola support to confirm the current process, since this is an area where Granola’s own controls may change.