Skip to main content
Every request to the MCP server carries a key: the one Claude or ChatGPT received when you authorized it, or an API key you created. The key needs the mcp scope to connect, and its other scopes decide which tools the client sees. A tool outside the key’s scopes is not listed, and calling it answers as an unknown tool.

​
Scopes

Some calls check a scope from their arguments. get_metrics_history needs apps:read for an application and databases:read for a database. create_database with connect_to_app also needs databases:credentials and envs:write, set_env_vars with restart also needs apps:control, and commit_application with snapshot also needs snapshots:write. Without it, that call answers MISSING_SCOPE and nothing runs. Claude and ChatGPT ask for all the scopes above. On the Square Cloud consent page you can uncheck any of them except mcp, but never add one. A connection never receives account:read, apps:deploy, ai:chat or the Blob Storage scopes, because no MCP tool uses them.
Some scopes reach further than their name suggests. files:write changes the code your application runs, envs:write changes its configuration and secrets, and databases:credentials rotates database passwords. Give a client only what it needs: for read-only access, use mcp with the :read scopes.

​
Keys restricted to applications and databases

An API key can be limited to some applications and databases. Over the MCP, such a key:
  • Only reaches those resources. A call that names any other application or database answers RESOURCE_NOT_ALLOWED before anything runs, and list_applications and list_databases return only the key’s resources.
  • Loses the account-wide tools: get_all_applications_status, list_account_domains, list_workspaces, create_application, upload_application, create_database, connect_database and rotate_database_credentials (a rotation updates every application that uses the database).
  • Names its target: list_snapshots and restore_snapshot need the application or database, since the account-wide overview covers resources outside the key.
Claude and ChatGPT connections cover the whole account. To keep an AI client to some applications, connect it with a restricted API key.

​
Every change runs at once

Every tool acts on the first call, deleting an application or a database and restoring a snapshot included. Square Cloud doesn’t ask you first: when to call a tool is your AI client’s decision. Every tool tells the client whether it only reads or can destroy something, and most clients ask your permission before a destructive tool: keep that prompt on.

​
Deletions and restores

delete_application, delete_database and restore_snapshot can’t be undone, so Square Cloud takes a safety snapshot of the application or database before acting, unless one from the last few minutes exists. The result’s safety_snapshot says which: While the snapshot is still being generated, nothing runs: the call answers SNAPSHOT_NOT_READY and the client tries again with the same arguments in about 2 minutes. The safety snapshot counts toward your plan’s daily snapshot limit. After a deletion, it stays in the dashboard, ready to download and upload as a new application: restore_snapshot only restores applications and databases that still exist.

​
Secrets

  • list_env_vars returns variable names only, and of a connection URL just its scheme and host.
  • The file tools never read, write or delete .env files (nor *.env, .env-* and .envrc; a template such as .env.example can be read) and never read private keys or certificates (.pem, .key, .p12, .pfx, .ppk, .jks and SSH keys such as id_rsa).
  • Secrets recognized in application logs are masked.
  • Download links of snapshots and certificates are never sent.
Logs and files of your applications are content the model reads, and text in them could try to steer it. Review what the client proposes before you allow it.

​
Activity feed

Changes made through the MCP appear in your activity feed (Standard plans and above) with MCP as their origin, under the same action as in the dashboard: a restart, a file upload, an environment variable change. Reads are not recorded. Authorizing Claude or ChatGPT appears as a client authorization.