MCP server
Security and permissions
What an AI assistant can see and change in your Platform account, and how to stay in control.
When you connect an AI assistant, it acts as you. Everything it does uses your plan, your limits and your credits, exactly as if you’d clicked it in the dashboard. The server checks permissions on every call. An assistant can’t reach anything your connection doesn’t allow, whatever it is asked to do.
What each connection can reach
| You connect with | The assistant can |
|---|---|
| Connection URL of the account owner | Use every website on the account, plus account and billing tools |
| Connection URL of a team member | Use only the website that was open when the URL was copied. Account and billing tools are refused |
| OAuth sign-in | Act as the person who signed in, with the same access they have in the dashboard |
Each tool page says which connections can use it.
What tools can do
Every tool page is labelled from the tool’s own MCP annotations, which assistants also read:
| Label | Meaning | Examples |
|---|---|---|
| Read-only | Looks things up, changes nothing | search_people, get_leads, list_campaigns |
| Changes data | Creates or edits something in your account | create_campaign, tag_lead, update_website |
| Deletes or overwrites data | Removes or replaces something; deleted data can’t be restored | delete_lead, delete_campaign, update_lead_scoring_model |
| Acts outside your account | Sends email, pushes to a CRM, buys a domain or charges your card | add_prospect_to_campaign, push_lead_to_crm, reply_to_prospect |
| Spends credits or money | Uses credits or charges your card | reveal_contact (1 credit), find_contact_email (50 or 100 credits), upgrade_plan, purchase_outreach_domains |
Some tools tell the assistant to confirm with you before they run. For example, upgrade_plan asks it to show you the new price and get an explicit yes first.
Stay in control
- Turn on tool approval in your assistant, so you see each tool call and approve it before it runs. This matters most for tools that spend credits or delete data.
- Start read-only. Ask questions first; let the assistant act once you trust what it’s doing.
- Use a team member’s URL for narrow jobs. It limits the assistant to one website and keeps billing out of reach.
- Watch other connectors. If other MCP servers or web browsing are on in the same chat, text from a web page or email can try to steer the assistant (prompt injection). Review any action you didn’t ask for.
Disconnect or replace a key
- Disconnect one assistant: remove the Platform connector in its settings (for example Settings → Connectors in Claude).
- A connection URL leaked: rotate the key in Integrations → API → Rotate Key. The old URL stops working at once; copy the new one from Integrations → MCP Server. See Authentication.