Security and attribution
This content is not available in your language yet.
What the URL can reach
Section titled “What the URL can reach”developers.mcp.security.reach.bodyV2 Tools reference
Answers about your own account never include your email address or phone number.
Deletes and paid actions ask you first
Section titled “Deletes and paid actions ask you first”Tools that delete, act irreversibly or cost more than the usual price change nothing when they are first called. They answer with what they would do, and with the live price for a paid action, so the assistant can ask you. Only after you agree does the assistant call again with your confirmation.
Text written by other people
Section titled “Text written by other people”developers.mcp.security.injection.bodyV2
How records are marked
Section titled “How records are marked”developers.mcp.security.marked.bodyV2
| Verified by | What it means |
|---|---|
| Posty5’s MCP server | The call came through your MCP URL. Posty5 confirms it was MCP and which assistant connected, as the assistant named itself. |
| Declared by the client | The call came with an API key from the local package or another program that says it is an assistant. Posty5 records what it was told and does not verify it. |
The activity log
Section titled “The activity log”In API Keys, choose Activity on a key to see every call its assistants made through the MCP URL — the tool, the assistant, the model, and whether the call succeeded, was refused or was rate limited. The log keeps a short summary of each call, with page content, addresses and anything that looks like a secret left out. Calls are kept for 90 days. The local package keeps no log.
If your URL leaks
Section titled “If your URL leaks”-
Open Manage MCP on the key and choose Rotate URL. The old URL stops at once. Paste the new one into your own assistants.
-
If the API key itself may have leaked, revoke the key instead. That stops the URL too.
-
Check the key’s Activity for calls you do not recognise.