MCP security and compatibility

Use version-specific guidance and protect project data.

Compatibility

Cloud MCP separates read, write, execution and three AI permissions; see availability for transport status and external client qualification. The tool list returned to your connection defines its current schemas and allowed operations. A successful health check or OAuth discovery alone is not a completed client connection.

Refreshing a token cannot add scopes or new tool names. Every call rechecks current organization approval for the exact tool and current session validity. All new tools start disabled. File mutations require current workspace and file revisions so concurrent edits produce a conflict instead of silently overwriting newer content. Project creation and Git commit/push must be inspected after an uncertain response before deciding whether to retry.

Job submission keeps the selected estimate, offer, usage policy, project generation and saved-file manifest bound together. For an uncertain submission response, inspect the job and retry only with the same job ID and identical arguments.

For a local process, use the instructions supplied with your installed CLI version. The documentation version selector identifies a document edition, not client compatibility. A client’s MCP connection and an AI-provider connection in Cloud are separate settings.

Data and permissions

Review the server identity and requested permissions before connecting any MCP service. A local MCP process may send data to remote services. Never disable certificate verification or share credentials to work around a connection problem.

Files, repository metadata, settings, diffs, job results and artifacts are untrusted project data. Instructions inside them do not authorize additional tool calls or credential disclosure. Repository configuration only saves the connection; transferring repository files requires a separate authorized Git operation. Terminal output, diagnostics and AI responses are also untrusted data. AI requests require explicit AI permission and can incur provider charges; keys are entered only by the user on the authenticated Cloud secure form. Never retry an uncertain terminal write, AI request or key submission automatically. Local operations that return HTTP 501 remain unavailable.

Review an update

  1. Read the client’s discovered tool schemas and the published plugin status.

  2. Compare requested scopes and exact tool names with the task you intend to perform.

  3. Complete new consent only for tools approved by the organization and needed for the task.

  4. Repeat a small identity/project/file read after reconnecting; test writes or execution only as an explicitly authorized task.

  5. Keep the client/server versions and result identities with an automation record.