MCP limits and actions that still need you
Account permissions apply, and protected approval, credentials and sign-in stay with the person.
MCP gives registered operations, not unrestricted database access or another customer's account.
| Boundary | What happens |
|---|---|
| Approve its own protected request | A person reviews and approves in the signed-in app. |
| Upgrade old consent silently | New management permissions need a fresh grant. |
| Bypass validation or permissions | Normal workspace, role and operation checks apply. |
| Start a campaign that fails checks | Refused even after review approval. |
| Enter or reveal connection secrets | Credential setup stays with the person. Previews do not reveal secrets. |
| Complete provider sign-in | A person completes the connection or authorisation. |
| Reveal withheld information | Existing held-data and contact checks apply. |
| Extract the whole book without limits | Search and extraction ceilings remain. |
| Keep spending indefinitely | Explicit AI and research retain their budgets. |
Sending, removal and recovery
These are not blanket omissions. Where registered operations support sending, publishing, restore or permanent file removal, they declare permission and review requirements. Some actions archive; others permanently remove data. Read the preview and warning rather than assuming every action can be undone.
Use tools/list, the developer catalogue and customer_operation_catalogue. Unavailable operations must not be bypassed with generic requests.
The public demo is separate: product help and labelled examples without private records, credentials or live account jobs.
See How protected MCP actions reach you for approval, Connector security and Keys, sign-in and permissions.