MCP safety and permissions

An AI agent acts with your access. These are the limits Lookio applies, and what is left to you.

What bounds an agent

• Scopes. You approve the scopes when you connect, and can untick any. A tool whose scope is missing is not listed, and a call to it fails with insufficient_scope anyway.
• Your permissions. A connection acts as you. If an admin takes a permission away, it is gone from your connections on their next call, and leaving the workspace revokes them.
• The member cap. An admin can limit what members may hand to AI clients. See Members and permissions.
• The workspace. A connection reaches one workspace, the one you chose when you approved it.
• Audience. A token can be tied to one server, so a token for the standard server does not open Code Mode.

Costs

Only ask_assistant spends credits directly, and it needs the query scope. A widget created through create_widget spends them later, when visitors ask: its limits cap that. If you do not want an agent to spend credits, do not grant query.

Every answer reserves credits before it starts. An agent in a loop spends fast, so keep an eye on usage after you connect a new client. See Credits and plans.

Confirmations

Tools that destroy or reshape data are marked destructive: delete_resource, delete_assistant, delete_widget, delete_conversation, delete_tag, rename_tag, update_site_rules and set_member_permissions. ask_assistant is marked the same way because it spends credits. Their descriptions tell the model to confirm with the person before calling. Most clients also ask you to approve each destructive call. Keep that setting on.

Deleting is permanent. See Deleting things.

Content is untrusted

An assistant answers from your resources, and a web page you import can contain text written to manipulate an AI agent. The text of a resource, a citation or an answer is data, not an instruction.

• Give an agent only the scopes its job needs.
• Prefer a read-only or Ask questions key for agents that read content from many sources.
• Review what an agent plans to do before it deletes or changes anything.
• Lookio instructs its own answer-writing model to treat sources as data and ignore instructions in them. That reduces the risk. It does not remove it for your agent.

Connect an agent safely

1. Use a personal connection for a person’s client, and a limited API key for an unattended agent.
2. Untick the scopes you do not need on the consent screen.
3. For an unattended agent, limit the key to the assistants it needs.
4. Set an expiry on keys.
5. Check Developer tools from time to time, and revoke what you no longer use.
6. Never paste a key, a token or a recovery code into a chat. Connect with the OAuth flow.

Report a problem

Agents can call send_feedback when a tool behaves differently from its description. It records the situation, costs no credits and changes nothing in your workspace. Feedback should not include keys, tokens or file contents.