MCP safety model
No tool can approve. Calls are tied to one workspace, writes reject stale versions, retries are idempotent, saved text is flagged as data, and everything is rate-limited and audited.
Updated 2026-10-13
| Risk | What stops it |
|---|---|
| An outside agent approving its own requests | There is no approval tool. list_approvals is read-only. Approving happens in Pythe, by you, with the exact content shown. |
| An agent reaching the wrong company | Each connection is bound to one workspace at consent. Every call loads that binding and passes your delegated token to the database, where row-level security decides. |
| Overwriting a newer plan | Plan writes compare the version read against the stored one and refuse a stale write. |
| Starting the same task twice on a retry | assign_task accepts an idempotency_key; the same key returns the existing run. |
| Spending without knowing | Tools that spend credits or computer time say so in their descriptions. Out-of-credit errors are explicit. Plan limits, credit guards and per-task budgets apply as in the app. |
| Instructions hidden in saved text | Library and memory reads are marked source: "untrusted" and the server tells the agent to treat them as data. |
| A leaked key | Keys are shown once, stored as hashes, scoped, expiring (default 90 days), rate-limited, rotatable and revocable, and every call is logged. |
| A failed save reported as success | A save that fails to reach the Library cannot be reported as a mission save. |
| A runaway loop | Rate limit of 60 calls a minute per key; polling hints tell clients how long to wait. |
What an agent should do
- Tell the founder what is waiting for approval and where to approve it.
- Send an email, post or publish only on the founder’s clear instruction. Pythe’s own employees need approval for these, and so should you.
- State exactly what changed and in which workspace after any write.
- Never paste an API key into a prompt.
What Pythe’s servers see
The server sees tool names and arguments, and the founder’s data needed to answer. Work started from your agent runs inside Pythe, so the same privacy terms apply. Pythe does not use your content to train AI models. See Privacy and data.
Related
Previous: Protocol notes for developers · Next: MCP troubleshooting