diff --git a/workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md b/workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md
new file mode 100644
index 0000000000..5cc585ff5a
--- /dev/null
+++ b/workspaces/intelligent-assistant/.changeset/mcp-tools-permissions.md
@@ -0,0 +1,18 @@
+---
+'@red-hat-developer-hub/backstage-plugin-intelligent-assistant-backend': major
+'@red-hat-developer-hub/backstage-plugin-intelligent-assistant-common': major
+'@red-hat-developer-hub/backstage-plugin-intelligent-assistant': major
+---
+
+Breaking changes to MCP permissions using behavior-linked vocabulary rather than CRUD-linked vocabulary:
+
+| Before (Lightspeed)     | Before (Intelligent Assistant)     | After              |
+| ----------------------- | ---------------------------------- | ------------------ |
+| `lightspeed.mcp.read`   | `intelligent-assistant.mcp.read`   | `mcp.tools.use`    |
+| `lightspeed.mcp.manage` | `intelligent-assistant.mcp.manage` | `mcp.tools.manage` |
+
+Removed permission CRUD action attributes; RBAC entries for these permission sets now use the generic `use` action.
+
+Permission variable renamed from `iaMcpReadPermission` to `iaMcpUsePermission`; `iaMcpManagePermission` keeps its name.
+
+Plugin documentation and example RBAC policy CSV updated to reflect the new MCP permission names.
diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md
index ad7f3015ed..efaa340669 100644
--- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md
+++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/README.md
@@ -88,8 +88,8 @@ Update permission names in your `rbac-policy.csv`:
 | `lightspeed.chat.delete`   | `intelligent-assistant.chat.manage`   |
 | `lightspeed.chat.update`   | `intelligent-assistant.chat.manage`   |
 | `lightspeed.notebooks.use` | `intelligent-assistant.notebooks.use` |
-| `lightspeed.mcp.read`      | `intelligent-assistant.mcp.read`      |
-| `lightspeed.mcp.manage`    | `intelligent-assistant.mcp.manage`    |
+| `lightspeed.mcp.read`      | `mcp.tools.use`                       |
+| `lightspeed.mcp.manage`    | `mcp.tools.manage`                    |
 
 #### 5. OFS dynamic plugin configuration
 
@@ -340,8 +340,8 @@ p, role:default/team_a, intelligent-assistant.chat.manage, use, allow
 p, role:default/team_a, intelligent-assistant.notebooks.use, update, allow
 
 # Required for MCP server management (if configured)
-p, role:default/team_a, intelligent-assistant.mcp.read, read, allow
-p, role:default/team_a, intelligent-assistant.mcp.manage, update, allow
+p, role:default/team_a, mcp.tools.use, use, allow
+p, role:default/team_a, mcp.tools.manage, use, allow
 
 # Required for saved prompts
 p, role:default/team_a, intelligent-assistant.saved-prompts.manage, update, allow
diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts
index db2e2aaad5..eb116558b9 100644
--- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts
+++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-backend/src/service/router.ts
@@ -32,7 +32,7 @@ import {
   iaChatManagePermission,
   iaChatUsePermission,
   iaMcpManagePermission,
-  iaMcpReadPermission,
+  iaMcpUsePermission,
   iaPermissions,
   iaSavedPromptsManagePermission,
   iaSkillsAccessPermission,
@@ -318,7 +318,7 @@ export async function createRouter(
   router.get(
     '/mcp-servers',
     generalRateLimiter,
-    requirePermission(iaMcpReadPermission),
+    requirePermission(iaMcpUsePermission),
     async (req, res) => {
       try {
         const { userEntityRef } = getIdentity(req);
@@ -359,7 +359,7 @@ export async function createRouter(
   router.post(
     '/mcp-servers/validate',
     generalRateLimiter,
-    requirePermission(iaMcpReadPermission),
+    requirePermission(iaMcpUsePermission),
     async (req, res) => {
       try {
         const { url, token } = req.body;
diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md
index 466a1f56d2..d8a03f984e 100644
--- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md
+++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/report.api.md
@@ -18,7 +18,7 @@ export const iaChatUsePermission: BasicPermission;
 export const iaMcpManagePermission: BasicPermission;
 
 // @public
-export const iaMcpReadPermission: BasicPermission;
+export const iaMcpUsePermission: BasicPermission;
 
 // @public
 export const iaNotebooksUsePermission: BasicPermission;
diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts
index 28d52a78b1..c9af496155 100644
--- a/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts
+++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant-common/src/permissions.ts
@@ -40,24 +40,20 @@ export const iaChatManagePermission = createPermission({
   attributes: {},
 });
 
-/** This permission is used to list configured MCP servers
+/** This permission is used to use MCP tooling
  * @public
  */
-export const iaMcpReadPermission = createPermission({
-  name: 'intelligent-assistant.mcp.read',
-  attributes: {
-    action: 'read',
-  },
+export const iaMcpUsePermission = createPermission({
+  name: 'mcp.tools.use',
+  attributes: {},
 });
 
-/** This permission is used to add, update, delete, and validate MCP servers
+/** This permission is used to manage MCP tooling
  * @public
  */
 export const iaMcpManagePermission = createPermission({
-  name: 'intelligent-assistant.mcp.manage',
-  attributes: {
-    action: 'update',
-  },
+  name: 'mcp.tools.manage',
+  attributes: {},
 });
 
 /** This permission is used to access AI Notebooks features
@@ -97,7 +93,7 @@ export const iaPermissions = [
   iaChatAccessPermission,
   iaChatManagePermission,
   iaChatUsePermission,
-  iaMcpReadPermission,
+  iaMcpUsePermission,
   iaMcpManagePermission,
   iaNotebooksUsePermission,
   iaSavedPromptsManagePermission,
diff --git a/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md b/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md
index 5bd48efb5b..57d0a5900d 100644
--- a/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md
+++ b/workspaces/intelligent-assistant/plugins/intelligent-assistant/README.md
@@ -45,8 +45,8 @@ p, role:default/team_a, intelligent-assistant.chat.manage, use, allow
 p, role:default/team_a, intelligent-assistant.notebooks.use, update, allow
 
 # Required for MCP server management (if configured)
-p, role:default/team_a, intelligent-assistant.mcp.read, read, allow
-p, role:default/team_a, intelligent-assistant.mcp.manage, update, allow
+p, role:default/team_a, mcp.tools.use, use, allow
+p, role:default/team_a, mcp.tools.manage, use, allow
 
 # Required for saved prompts
 p, role:default/team_a, intelligent-assistant.saved-prompts.manage, update, allow
diff --git a/workspaces/intelligent-assistant/rbac-policy.csv b/workspaces/intelligent-assistant/rbac-policy.csv
index 8716e2eb58..b46552e8c3 100644
--- a/workspaces/intelligent-assistant/rbac-policy.csv
+++ b/workspaces/intelligent-assistant/rbac-policy.csv
@@ -9,8 +9,8 @@
 p, role:default/intelligent-assistant-user, intelligent-assistant.chat.access, use, allow
 p, role:default/intelligent-assistant-user, intelligent-assistant.chat.use, use, allow
 p, role:default/intelligent-assistant-user, intelligent-assistant.chat.manage, use, allow
-p, role:default/intelligent-assistant-user, intelligent-assistant.mcp.read, read, allow
-p, role:default/intelligent-assistant-user, intelligent-assistant.mcp.manage, update, allow
+p, role:default/intelligent-assistant-user, mcp.tools.use, use, allow
+p, role:default/intelligent-assistant-user, mcp.tools.manage, use, allow
 p, role:default/intelligent-assistant-user, intelligent-assistant.notebooks.use, update, allow
 p, role:default/intelligent-assistant-user, intelligent-assistant.skills.access, use, allow