MCP permissions
Beta
Principle
Capability ≠ permission. A model can request a tool call; your allowlist decides whether it may execute.
Permission layers
- Server-level allowlist — which tools of a server exist at all.
- Permission mode — the application can require an explicit decision for sensitive calls.
- Lifecycle isolation — timeouts and process exits are contained; tool results carry server/tool provenance.
Defaults
| Action type | Default |
|---|---|
| Read / search | Allowed when tool is allowlisted |
| Write / delete | Explicit per-tool opt-in; use an approval mode where available |
| Shell / process execution | Not exposed by default — avoid unless strictly necessary |
| Network calls from tools | Explicit opt-in per server |
Never do this
- Do not register
*wildcards for filesystem or shell servers. - Do not disable logging "temporarily".
- Do not let a model's own output add servers to the registry.
Auditing
Review the server and tool state in the application's MCP surface and local diagnostics. A botconnector mcp log command is not part of this release, so do not rely on it.