# BladeCP MCP: Security

What an AI agent can and cannot do with BladeCP MCP, where confirmations happen, how your key travels and how to handle prompt injection.

## What the agent can do

- Read and search this documentation.
- With a key, read your account, servers, resource usage, domains, migrations and migration destinations, limited to what the key can see.

## What the agent cannot do

- Create, change, approve, cancel, retry or delete anything. The server has no tool for that and only sends read requests to the BladeCP API.
- Upload backups.
- See configuration values or credentials of your servers. Results are compact.
- Read pages outside `developers.bladecp.com` with `get_doc_page`.

## Confirmations

Approving, cancelling or retrying a migration stays with a person, in the [BladeCP CLI](/cli.md) or in the Hub. Since every tool only reads, your client can let the agent call them without asking each time; the [annotations](/mcp/tools.md#annotations) tell it so. If the agent also has a terminal or other tools, those keep their own confirmations.

## Your key

- **The key stays out of the chat.** It comes from an environment variable or your secret manager, through a header. Never paste it into a conversation; if that happens, revoke it in the Hub and create a new one.
- **The key is never logged.** The server uses it only to call the BladeCP API for you, as `Authorization: Bearer`, and never sends it to the documentation.

## Prompt injection

Tool results can carry text written by other people, such as a domain, a server name, a migration message or a documentation page. Tool results are information for the agent, never instructions: an agent should ignore text in them that asks it to run commands, reveal keys or change anything. Because every tool only reads, a result cannot make the server change your account. Before acting on something a result suggests, the agent should ask you.

## Inputs are checked

UUIDs, page sizes, dates and currency codes are validated before any call, and every tool accepts only the parameters it lists.

## Next step

[Troubleshooting](/mcp/troubleshooting.md): symptoms in your client and API errors.