Permissions and safety

The server holds no credential of its own. It acts as you, with your roles and plan, and the workspace kill switch can cut it off entirely.

The MCP server holds no credential of its own. Every tool call is forwarded to the CentralCSP API carrying your access token, so every guard, quota, and audit entry applies to you exactly as on a direct API call.

It has your permissions, not fewer

There is no per-tool or per-client permission model. The agent can reach whatever you can reach.

A workspace admin connecting a client grants it workspace-wide access

Workspace Owners and Admins are website Admin on every site automatically. Connecting an AI client from such an account gives it read access to every website in the workspace, and write access to everything the tools cover. If you want a narrower blast radius, connect from an account that is a workspace Member with grants on specific websites.

A 403 from a tool means your account lacks the role or your plan lacks the feature. It is not a fault in the server.

What no tool can do

Some capabilities have no tool at all, so they cannot be reached however the agent is prompted:

Deleting anything. No website, member, rule, tag, payment page, or report.
Membership. Inviting, removing, or changing a member's role.
Website access. Granting or revoking access for people or groups.
Security settings. Two-factor enforcement, the AI kill switch, API key creation.
Billing. Reading or changing the subscription.

This is a property of the tool registry rather than a permission check, which is the stronger guarantee.

Everything is audited as you

Actions taken through MCP appear in the workspace audit log attributed to your account, indistinguishable from the same action taken in the dashboard.

The same applies to compliance decisions. A script justified through an agent is recorded in the change ledger with your name on it and lands in the evidence pack that way. That is a good reason to review agent-drafted justifications before saving them rather than after. See Justifying scripts.

Data leaves CentralCSP

Everything a tool returns goes to your model provider. That includes page URLs, blocked origins, script URLs and hashes, member names and email addresses, and audit entries.

Decide whether that is acceptable for your data before connecting a client, particularly on payment-facing sites where report URLs can be revealing.

The kill switch

Settings > General > Disable AI agent integrations cuts every AI client off from the workspace.

Tokens carrying the mcp scope are refused from the next request, and no new connection can be made. Nothing is deleted, so turning it back on restores access without reconnecting clients.

It is keyed on the mcp scope, which is why the server requires that scope in the first place: it is what lets CentralCSP tell an AI client from a dashboard session and refuse one without touching the other.

Use it as an incident control, or leave it on as a standing policy if AI access has not been approved in your organization.

Reducing exposure

If you want the capability with less reach:

Connect from a Member account, not an Admin, with website grants limited to what the agent needs.
Use a separate workspace for the sites you are willing to expose.
Leave the kill switch on except when you are actively using an agent.

There is no read-only mode and no way to disable individual tools.