Security
What an AI agent can and cannot do with BladeCP MCP, where confirmations happen, how your key travels and how to handle prompt injection.
What the agent can do
- Read and search this documentation.
- With a key, read your account, servers, resource usage, domains, migrations and migration destinations, limited to what the key can see.
What the agent cannot do
- Create, change, approve, cancel, retry or delete anything. The server has no tool for that and only sends read requests to the BladeCP API.
- Upload backups.
- See configuration values or credentials of your servers. Results are compact.
- Read pages outside
developers.bladecp.comwithget_doc_page.
Confirmations
Approving, cancelling or retrying a migration stays with a person, in the BladeCP CLI or in the Hub. Since every tool only reads, your client can let the agent call them without asking each time; the annotations tell it so. If the agent also has a terminal or other tools, those keep their own confirmations.
Your key
- The key stays out of the chat. It comes from an environment variable or your secret manager, through a header. Never paste it into a conversation; if that happens, revoke it in the Hub and create a new one.
- The key is never logged. The server uses it only to call the BladeCP API for you, as
Authorization: Bearer, and never sends it to the documentation.
Prompt injection
Tool results can carry text written by other people, such as a domain, a server name, a migration message or a documentation page. Tool results are information for the agent, never instructions: an agent should ignore text in them that asks it to run commands, reveal keys or change anything. Because every tool only reads, a result cannot make the server change your account. Before acting on something a result suggests, the agent should ask you.
Inputs are checked
UUIDs, page sizes, dates and currency codes are validated before any call, and every tool accepts only the parameters it lists.
Next step
Troubleshooting: symptoms in your client and API errors.