MCP security and limits

Connections are isolated to your workspace by the database itself, logged in full, and rate limited.

Every tool call runs inside a transaction scoped to your workspace. Isolation is enforced by the database, not by the code handling the request, and the MCP layer holds no elevated database access it could use to step outside.

A test running two workspaces with deliberately overlapping identifiers against every tool has to pass before any release ships.

Calls are rate limited. An interactive assistant is allowed sixty calls a minute. There is also a daily ceiling on write operations.

Every call is recorded — which tool, which workspace, on whose authority. Administrators can review this alongside the rest of the audit log.

Access tokens expire and refresh in the background. Revoking an assistant in Settings stops it on its next call.

Your data still leaves the workspace when you use an assistant, because the assistant is not ours. What it does with what it reads is governed by whoever supplies it. Consider that before granting commercial reading to an assistant you do not control.