MCP security model and role scopes

MCP tokens inherit the calling member's role, further clamped by an optional role override. Writes require confirm. Admin actions require admin.

Quick answer

Effective role = min(member role, token role override). Read tools need viewer+, writes need member+ and confirm: true, and add_maintenance_window needs admin.

Guardrails

• Tokens are org-scoped — never cross-tenant
• Every call re-validates the calling member's role
• Prompt-injection defense: writes require explicit confirm: true from the model
• Full audit trail in api_request_logs

Where to find it in Lemwatch

Settings → MCP tokens → Role override when issuing a token.

How to lock a token down

1. Issue a token with role override = viewer.
2. Give it to your AI client for read-only workflows.
3. Keep admin-capable tokens for humans only.
4. Rotate quarterly.

FAQ

Can a token escalate its own role?

No. Role override can only reduce privileges.

What if a member is removed?

All tokens they created continue to work (they're org-scoped), but you should revoke any they no longer need.

Related

• Manage MCP tokens
• MCP tool catalog
• Roles and permissions