> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP security

> Review MCP operators, credential scope, and stored approval policies while discovery and runtime enforcement remain unavailable.

Before connecting an MCP server, identify its operator, the data it receives, and the actions its credentials allow. A server configuration and an agent attachment are separate resources to review.

<Note>
  Threetone can store server configuration and tool approval records. Tool discovery is unavailable, and **Test Connection** is disabled. Stored approval settings do not establish live confirmation, tool-change detection, or execution enforcement.
</Note>

## Review the connection

<Steps>
  <Step title="Verify the operator and endpoint">
    Follow [MCP server setup](/agents-platform/configure/integrations/mcp-servers). Confirm the intended HTTPS endpoint and transport with the operator. Selecting **I trust this server** records your acknowledgement; it is not a Threetone verification of the server.
  </Step>

  <Step title="Limit credentials and transmitted data">
    Use the supported [secret](/agents-platform/configure/authentication/secrets) or [auth-connection](/agents-platform/configure/authentication/auth-connections) workflow. Review `secret_token`, `request_headers`, `request_meta`, and `auth_connection` as applicable. Keep the credential's actual permissions limited to the required actions.

    A secret reference avoids placing a credential in authored prose. It does not reduce the permissions held by the receiving server.
  </Step>

  <Step title="Record approval intent">
    Review `approval_policy` and any per-tool records. Keep an operator-supplied copy of the tool names, descriptions, and input schemas while live discovery is unavailable. Do not describe that copy as a successful connection test.
  </Step>

  <Step title="Read back the saved resources">
    Use [Get MCP server](/api-reference/agents-platform/get-mcp-server) to inspect configuration and stored approval records. Separately inspect the intended server ID in the agent draft's `mcp_server_ids` list.
  </Step>
</Steps>

## Approval fields

| Scope | Values and records |
| - | - |
| Server `approval_policy` | `require_approval_all` by default, `require_approval_per_tool`, or `auto_approve_all`. |
| Per-tool `approval_policy` | `requires_approval` by default or `auto_approved`. |
| Per-tool approval request | `tool_name`, `tool_description`, `input_schema`, and the policy. |
| Stored approval record | `tool_name`, `tool_hash`, and the policy. |

[Create MCP server tool approval](/api-reference/agents-platform/create-mcp-server-tool-approval) stores a hash derived from the supplied name, description, and input schema. That record does not demonstrate that a future changed tool is blocked. Review changed definitions and remove obsolete approvals through the corresponding [delete operation](/api-reference/agents-platform/delete-mcp-server-tool-approval).

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Does require_approval_all guarantee a confirmation dialog?" id="faq-mcp-security-confirmation">
    No. It stores an approval policy. The actual runtime confirmation and enforcement path must be verified when execution is available.
  </Accordion>

  <Accordion title="Can a server's tool instructions authorize access?" id="faq-mcp-security-authorization">
    No. Your application and the service owning the data must enforce authorization. Tool descriptions and returned content do not grant permission to read or change resources.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.