Give it a ladder, not a master key
An agent's reach should grow one step at a time. Runner's MCP endpoint uses these boundaries:
Read
Look up a small answer inside approved projects.
Propose
Draft a change with the records behind it. Leave the customer's record untouched.
Change
Run a change only after a person approves that exact call.
Excluded
Irreversible, destructive or wide-reaching tools are never offered. That isn't a setting anyone can change — the endpoint has no path to serve them.
Permissions stay current
A connection gets the projects a person approved, and the tools their role permits. Runner checks both again on each request.
Revoke the connection or change the role, and the next request uses that decision.
The connection details
Clients connect with OAuth and PKCE using SHA-256, with no API key to paste into a configuration file. The server derives the organization from the approved project. Unknown and ungranted tools return the same generic refusal. A tool's safety hints describe it to the client; they grant no permission.
Propose before you write
Runner's proposing tool drafts a contact note in the agent's ledger. Each proposal cites at least one record and explains why it supports the note. A person reads it, then applies, edits or discards it where they already write notes.
The agent and person have separate identities. The agent records no outcome for its own proposal; an outcome is written once. Caps per contact and per hour keep a loop from filling the queue.
Approve one exact call
For an approval-gated change, the first call files a request and is refused. A person decides it in Runner.
The approval binds the tool, its version, the organization, the accountable person and the exact input. Change an argument and the call needs its own approval. An approval with no expiry counts as expired.
Every change tool must declare evidence, an undo plan and limits before the server starts. Limits are checked before anyone is asked to approve.
Stop at the size of the problem
Owners and admins can pause agent traffic at four sizes:
- One tool — stop repeated calls.
- One project — contain the affected work.
- One person's connections — pause their delegated access.
- The workspace — stop agent traffic across it.
Before you connect
Ask any MCP server for clear answers to these:
- Are permissions checked on every request?
- Does a proposal leave the customer's record untouched?
- Does approval bind one exact call?
- Does every change have an undo plan and limits?
- Can you stop at the size of the problem?
Give your business a growth team.
Create your account and pick a plan. Your team is built once the plan is paid.
