> ## Documentation Index > Fetch the complete documentation index at: https://docs.squarecloud.app/llms.txt > Use this file to discover all available pages before exploring further. # MCP permissions and safety > How scopes and restricted API keys decide what an AI client can do on the Square Cloud MCP server, how deletions and restores keep a safety snapshot, and the activity feed. Every request to the MCP server carries a key: the one Claude or ChatGPT received when you authorized it, or an [API key](https://docs.squarecloud.app/en/mcp/connect.md#create-an-api-key) you created. The key needs the `mcp` scope to connect, and its other scopes decide which [tools](https://docs.squarecloud.app/en/mcp/tools.md) the client sees. A tool outside the key's scopes is not listed, and calling it answers as an unknown tool. ## Scopes | Scope | Tools it unlocks | | - | - | | `mcp` | Required to connect. On its own it gives the tools that need no other scope: `get_platform_knowledge`, `search_help_center`, `list_help_center`, `get_platform_status` and `get_discord_status`. | | `apps:read` | `list_applications`, `get_application_status`, `get_all_applications_status`, `get_application_logs`, `get_deployments`, `get_metrics_history` (applications), `list_account_domains`, `list_dns_records`, `get_network_analytics`, `get_network_errors`, `get_network_performance`, `get_network_logs` | | `apps:control` | `start_application`, `stop_application`, `restart_application` | | `apps:write` | `create_application`, `upload_application`, `purge_network_cache`, `set_custom_domain`, `delete_application` | | `files:read` | `list_files`, `read_file`, `search_files` | | `files:write` | `create_file`, `edit_file`, `patch_file`, `rename_file`, `delete_file`, `edit_config_file`, `commit_application` | | `envs:read` | `list_env_vars` | | `envs:write` | `set_env_vars`, and with `databases:credentials`: `connect_database`, `rotate_database_credentials` and `create_database` with `connect_to_app` | | `snapshots:read` | `list_snapshots` | | `snapshots:write` | `create_snapshot`, `restore_snapshot`, and `commit_application` with `snapshot` | | `databases:read` | `list_databases`, `get_metrics_history` (databases) | | `databases:write` | `create_database`, `start_database`, `stop_database`, `update_database`, `delete_database` | | `databases:credentials` | With `envs:write`: `connect_database`, `rotate_database_credentials` and `create_database` with `connect_to_app` | | `workspaces:manage` | `list_workspaces` | Some calls check a scope from their arguments. `get_metrics_history` needs `apps:read` for an application and `databases:read` for a database. `create_database` with `connect_to_app` also needs `databases:credentials` and `envs:write`, `set_env_vars` with `restart` also needs `apps:control`, and `commit_application` with `snapshot` also needs `snapshots:write`. Without it, that call answers `MISSING_SCOPE` and nothing runs. Claude and ChatGPT ask for all the scopes above. On the Square Cloud consent page you can uncheck any of them except `mcp`, but never add one. A connection never receives `account:read`, `apps:deploy`, `ai:chat` or the Blob Storage scopes, because no MCP tool uses them. > [!WARNING] > > Some scopes reach further than their name suggests. `files:write` changes the code your application runs, `envs:write` changes its configuration and secrets, and `databases:credentials` rotates database passwords. Give a client only what it needs: for read-only access, use `mcp` with the `:read` scopes. ## Keys restricted to applications and databases An [API key](https://docs.squarecloud.app/en/api-reference/authentication.md#restricting-a-key-to-resources) can be limited to some applications and databases. Over the MCP, such a key: * **Only reaches those resources.** A call that names any other application or database answers `RESOURCE_NOT_ALLOWED` before anything runs, and `list_applications` and `list_databases` return only the key's resources. * **Loses the account-wide tools:** `get_all_applications_status`, `list_account_domains`, `list_workspaces`, `create_application`, `upload_application`, `create_database`, `connect_database` and `rotate_database_credentials` (a rotation updates every application that uses the database). * **Names its target:** `list_snapshots` and `restore_snapshot` need the application or database, since the account-wide overview covers resources outside the key. Claude and ChatGPT connections cover the whole account. To keep an AI client to some applications, connect it with a restricted API key. ## Every change runs at once Every tool acts on the first call, deleting an application or a database and restoring a snapshot included. Square Cloud doesn't ask you first: when to call a tool is your AI client's decision. Every tool tells the client whether it only reads or can destroy something, and most clients ask your permission before a destructive tool: keep that prompt on. ## Deletions and restores `delete_application`, `delete_database` and `restore_snapshot` can't be undone, so Square Cloud takes a safety snapshot of the application or database before acting, unless one from the last few minutes exists. The result's `safety_snapshot` says which: | `status` | Meaning | | - | - | | `created` | A safety snapshot was taken. | | `recent` | A snapshot from the last few minutes already existed. | | `none` | No snapshot could be taken, and the action ran anyway. `reason` is `daily_limit` when your plan's daily snapshot limit is used up, or `failed`. | While the snapshot is still being generated, nothing runs: the call answers `SNAPSHOT_NOT_READY` and the client tries again with the same arguments in about 2 minutes. The safety snapshot counts toward your plan's daily snapshot limit. After a deletion, it stays in the dashboard, ready to download and upload as a new application: `restore_snapshot` only restores applications and databases that still exist. ## Secrets * `list_env_vars` returns variable names only, and of a connection URL just its scheme and host. * The file tools never read, write or delete `.env` files (nor `*.env`, `.env-*` and `.envrc`; a template such as `.env.example` can be read) and never read private keys or certificates (`.pem`, `.key`, `.p12`, `.pfx`, `.ppk`, `.jks` and SSH keys such as `id_rsa`). * Secrets recognized in application logs are masked. * Download links of snapshots and certificates are never sent. > [!NOTE] > > Logs and files of your applications are content the model reads, and text in them could try to steer it. Review what the client proposes before you allow it. ## Activity feed Changes made through the MCP appear in your [activity feed](https://squarecloud.app/en/dashboard/activity) (Standard plans and above) with **MCP** as their origin, under the same action as in the dashboard: a restart, a file upload, an environment variable change. Reads are not recorded. Authorizing Claude or ChatGPT appears as a client authorization. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.