MCP safety and permissions

An AI agent acts with your access. These are the limits Lookio applies, and what is left to you.

What bounds an agent

• Scopes. You approve the scopes when you connect, and can untick any. Lookio does not list a tool without its scope. A call to it fails with insufficient_scope.
• Your permissions. A connection acts as you. If an admin removes a permission, your connections lose it on their next call. If you leave the workspace, they lose everything.
• The member limit. An admin can limit what members may give to AI clients. See Members and permissions.
• The workspace. A connection reaches one workspace: the one you chose when you approved it.
• Audience. A token can be for one server only. A token for the standard server then does not open Code Mode.

Costs

Only ask_assistant and search_assistant spend credits directly. Both need the query scope. A widget made with create_widget spends credits later, when visitors ask, within its limits. If an agent must not spend credits, do not grant query.

An agent in a loop spends fast. Check your usage after you connect a new client. See Credits and plans.

Confirmations

These tools have the destructive mark:

• They delete or change data: delete_resource, delete_assistant, delete_widget, delete_access, delete_conversation, delete_tag, rename_tag, update_site_rules, update_access, revoke_access_key, unpublish_assistant and set_member_permissions.
• They spend credits: ask_assistant and search_assistant.

Their descriptions tell the model to confirm with the person first. Most clients also ask you to approve each destructive call. Keep that setting on.

Deleting is permanent. See Deleting things.

Content is untrusted

A web page that you import can contain text written to manipulate an AI agent. The text of a resource, a citation or an answer is data, not an instruction.

• Give an agent only the scopes its job needs.
• For agents that read content from many sources, use a read-only or Ask questions key.
• Before an agent deletes or changes something, review its plan.
• Lookio tells its own answer model to treat sources as data and ignore instructions in them. This reduces the risk for your agent, but does not remove it.

Connect an agent safely

1. Use a personal connection for a person’s client, and a limited API key for an unattended agent.
2. Untick the scopes you do not need on the consent screen.
3. For an unattended agent, limit the key to the assistants it needs.
4. Set an expiry on keys.
5. Check Developer tools from time to time, and revoke what you do not use.
6. Never paste a key, a token or a recovery code into a chat. Connect with OAuth.

Report a problem

When a tool does not do what its description says, an agent can call send_feedback. It is free and changes nothing in your workspace. Do not put keys, tokens or file contents in it.