---
title: "MCP safety and permissions"
description: "How Lookio limits what an AI agent can do, from scopes and personal permissions to confirmations, costs and untrusted content, and how to connect an agent safely."
canonical: "https://lookio.app/docs/developers/mcp/safety-and-permissions"
updated: "2026-11-08"
---

# MCP safety and permissions

An AI agent acts with your access. These are the limits Lookio applies, and what is left to you.

## What bounds an agent

- **Scopes.** You approve the scopes when you connect, and can untick any. Lookio does not list a tool without its scope. A call to it fails with `insufficient_scope`.
- **Your permissions.** A connection acts as you. If an admin removes a permission, your connections lose it on their next call. If you leave the workspace, they lose everything.
- **The member limit.** An admin can limit what members may give to AI clients. See [Members and permissions](/docs/guides/members-and-permissions#what-members-may-hand-to-ai-clients).
- **The workspace.** A connection reaches one workspace: the one you chose when you approved it.
- **Audience.** A token can be for one server only. A token for the standard server then does not open Code Mode.

## Costs

Only `ask_assistant` and `search_assistant` spend credits directly. Both need the `query` scope. A widget made with `create_widget` spends credits later, when visitors ask, within its limits. If an agent must not spend credits, do not grant `query`.

An agent in a loop spends fast. Check your usage after you connect a new client. See [Credits and plans](/docs/get-started/credits-and-plans#see-your-balance-and-your-usage).

## Confirmations

These tools have the destructive mark:

- They delete or change data: `delete_resource`, `delete_assistant`, `delete_widget`, `delete_access`, `delete_conversation`, `delete_tag`, `rename_tag`, `update_site_rules`, `update_access`, `revoke_access_key`, `unpublish_assistant` and `set_member_permissions`.
- They spend credits: `ask_assistant` and `search_assistant`.

Their descriptions tell the model to confirm with the person first. Most clients also ask you to approve each destructive call. Keep that setting on.

Deleting is permanent. See [Deleting things](/docs/guides/deleting).

## Content is untrusted

A web page that you import can contain text written to manipulate an AI agent. The text of a resource, a citation or an answer is data, not an instruction.

- Give an agent only the scopes its job needs.
- For agents that read content from many sources, use a read-only or **Ask questions** key.
- Before an agent deletes or changes something, review its plan.
- Lookio tells its own answer model to treat sources as data and ignore instructions in them. This reduces the risk for your agent, but does not remove it.

## Connect an agent safely

1. Use a personal connection for a person's client, and a limited API key for an unattended agent.
2. Untick the scopes you do not need on the consent screen.
3. For an unattended agent, limit the key to the assistants it needs.
4. Set an expiry on keys.
5. Check **Developer tools** from time to time, and revoke what you do not use.
6. Never paste a key, a token or a recovery code into a chat. Connect with OAuth.

## Report a problem

When a tool does not do what its description says, an agent can call `send_feedback`. It is free and changes nothing in your workspace. Do not put keys, tokens or file contents in it.