The three kinds
Database. Postgres or MySQL. Host, port, database, username, password, and TLS settings if you need them. The assistant gets arun_sql_query tool.
SSH. Host, port, username, and either a password or a private key with an
optional passphrase. The assistant gets an ssh_run_command tool.
MCP. A URL and a transport, either HTTP or SSE. Authentication can be none,
a header, a bearer token or OAuth. The server’s own tools appear to the
assistant with their real names and descriptions.
New connectors are read only by default.
Nothing writes without you
Reads run. Anything that could change something stops and asks. For SQL, statements beginningselect, with, show, explain, describe,
values or table are reads. Everything else is a write and is gated. So is
anything with multiple statements, a CTE that hides an insert or delete inside
it, and a select with an into, which creates a table, a variable or a file.
Comments are only comments outside quotes, and a MySQL executable comment is
judged by what it runs. A query that uses dollar quoting or a backslash escape
inside a string asks first, because those are not analysed.
A query that runs without asking is sent as exactly one statement inside a read
only transaction. On PostgreSQL the database itself refuses a second statement,
and on MySQL the driver does, so a read cannot smuggle in a write even if it
was misjudged.
Every SSH command is gated, with no read and write distinction, because a
shell command is too easy to disguise.
MCP tools skip the gate only when the server itself declares them read only.
Approving
When something is gated you get four choices.
Commands judged dangerous, such as
drop, truncate, grant, rm, dd,
sudo or anything carrying shell metacharacters, are marked Dangerous action,
review carefully and cannot be added to an allow list. They can only ever be
approved one at a time.
An allow list entry is scoped to one chat and one connector. It does not carry
over to another conversation. An entry keeps at least the first two words of the
command, so allowing docker ps never also allows docker run.