Academy
8. Security, Scopes & Cost Model
Evaluate the security posture of MCP connections — scoped OAuth grants, logged calls, approval gates for sensitive actions — and understand how tool-call costs fold into conversation, run, or workflow credits.
MCP connections authenticate via the external service's own OAuth flow. When you create a connection, you explicitly grant scoped permissions — the AI can only reach what those scopes allow. This is critical: a connection to your project tracker scoped to read-only will never let the AI create or delete tasks. You control the blast radius at authorization time, and you can tighten or revoke scopes on the service side at any moment. Sensitive actions can also be gated by approval prompts, adding a human-in-the-loop checkpoint before the AI executes anything destructive. The combination of scoped OAuth grants, approval gates, and the principle of least privilege makes MCP connections auditable and containable by design.
Every single tool call the AI makes through an MCP connection is recorded in the execution log. Each entry captures the tool name, timestamp, the origin surface (ChatPro, Studio, workflow, Deep Research, etc.), and the outcome (success or failure). This gives you a full audit trail. As an advanced developer, you should treat this log as your primary debugging and compliance artifact: if a workflow misbehaves or a user reports unexpected side-effects, the execution log is where you reconstruct exactly what happened, in what order, and whether the external service returned an error.
Tool calls do not carry a separate price tag. Their cost folds into the AI operation that triggers them: if a ChatPro conversation invokes an MCP tool, the credits consumed by that conversation already include the tool call. The same applies to agent runs in Studio and to workflow step executions. This means you don't need to budget separately for MCP usage — but you do need to be aware that complex chains of tool calls within a single run will increase that run's total credit consumption proportionally. Monitor your execution log alongside your credit dashboard to correlate spikes.
When a connection dies, it's almost always an expired or revoked OAuth token on the service side. Before debugging your workflow logic, check the connection status in the MCP Hub and re-authorize. After deleting a connection in OUPI, also revoke it in the external service's connected-apps settings for a clean cut.
Tool inspection lets you see the exact list of tools a connection exposes — this is the same list the AI model receives at inference time. Open any connection to review tool names and descriptions. As a developer, use this to verify that a newly authorized connection actually surfaces the capabilities you expect. If a tool is missing, the service may require broader scopes or a different plan. This transparency eliminates guesswork: what you see is precisely what the AI can call.
Open the MCP Hub → Executions log. Filter for the last 24 hours and identify which tool was called most frequently, from which surface, and whether any calls failed. Cross-reference a failed call with the connection's tool list to confirm the scope still covers that action.
MCP security rests on three pillars: scoped OAuth grants (you choose what the AI can reach), a complete execution log (every call is recorded with tool, time, origin, and outcome), and approval gates for sensitive actions. Tool-call costs are not billed separately — they fold into the credits of the conversation, agent run, or workflow that triggered them. Inspect your connections' tool lists to confirm exposed capabilities, and audit the execution log regularly for compliance and debugging.