Security and attribution

This content is not available in your language yet.

What the URL can reach

The URL acts as its API key, but only through the tools in the tools reference. It cannot reveal your API key, manage API keys, change account settings, connect social accounts or suppliers, or enter supplier credentials. Tools reference

Answers about your own account never include your email address or phone number.

Deletes and paid actions ask you first

Tools that delete, act irreversibly or cost more than the usual price change nothing when they are first called. They answer with what they would do, and with the live price for a paid action, so the assistant can ask you. Only after you agree does the assistant call again with your confirmation.

Text written by other people

Some tools return text other people wrote — form submissions on your hosted pages, store orders, post captions, supplier product pages. Posty5 tells the assistant to treat that text as data and never as instructions, but no assistant is perfect. Be wary when, in the middle of a task, the assistant suddenly wants to do something you did not ask for.

Your shoppers’ personal data

The store-orders group returns shoppers’ names, addresses and phone numbers to the assistant, and so to the company that runs it. It is off by default. Turn it on only if your shoppers’ data may go there.

How records are marked

Everything an assistant creates through MCP shows Created via MCP in the dashboard and in the store control panel, with the assistant and the model that made it. Only creation is recorded on the record — changes and deletes appear in the activity log.

Verified by	What it means
Posty5’s MCP server	The call came through your MCP URL. Posty5 confirms it was MCP and which assistant connected, as the assistant named itself.
Declared by the client	The call came with an API key from the local package or another program that says it is an assistant. Posty5 records what it was told and does not verify it.

The activity log

In API Keys, choose Activity on a key to see every call its assistants made through the MCP URL — the tool, the assistant, the model, and whether the call succeeded, was refused or was rate limited. The log keeps a short summary of each call, with page content, addresses and anything that looks like a secret left out. Calls are kept for 90 days. The local package keeps no log.

If your URL leaks

Open Manage MCP on the key and choose Rotate URL. The old URL stops at once. Paste the new one into your own assistants.
If the API key itself may have leaked, revoke the key instead. That stops the URL too.
Check the key’s Activity for calls you do not recognise.