MCP security and permissions

One person, one workspace, one access level

A connection is created when you approve it on Saver Option's consent screen. You choose one workspace and either Read only or Read and change. The AI client can never reach another workspace.

Your current role applies to every request. If your role is lowered or you leave the workspace, the connection's next request is refused.

What an AI client can do

• Read subscriptions, spending, renewals, savings opportunities and Saver Option deals.
• With Read and change: add and update subscription records. Each change is first returned as a preview; it's saved only when the client calls again with confirm: true after you agree.
• Generate and save a savings report (roles with export access).

What it can't do

• Cancel, renew or buy subscriptions, make payments, or change anything at a vendor.
• Delete records, manage members or change workspace settings.
• Run arbitrary queries or code. Every tool has a fixed input schema that the server validates.
• Access your Google account.

Tokens

• Sign-in uses OAuth 2.1 with PKCE (S256). Access tokens last one hour; refresh tokens last 30 days and change on every use.
• Tokens are stored only as SHA-256 hashes. They're never put in URLs or shown to the model.
• Reusing an old refresh token or authorization code revokes the whole connection.
• Each connection is limited to 120 requests a minute.

Disconnecting

Settings → AI clients (MCP) lists your connections — owners and admins see everyone's. Disconnect ends a connection immediately. Connecting and disconnecting are recorded in the audit log, as are records the AI client adds or changes.

Data sent to the AI client

The client receives only what each tool returns, not the whole workspace. Once it has the data, it's processed by that client under its own terms. Payment-method labels aren't returned by any tool.