The three kinds
Database. Postgres or MySQL. Host, port, database, username, password, and TLS settings if you need them. The assistant gets arun_sql_query tool.
SSH. Host, port, username, and either a password or a private key with an
optional passphrase. The assistant gets an ssh_run_command tool.
MCP. A URL and a transport, either HTTP or SSE. Authentication can be none,
a header, a bearer token or OAuth. The server’s own tools appear to the
assistant with their real names and descriptions.
New connectors are read only by default.
Nothing writes without you
Reads run. Anything that could change something stops and asks. For SQL, statements beginningselect, with, show, explain, describe,
values or table are reads. Everything else is a write and is gated. So is
anything with multiple statements, and a CTE that hides an insert or delete
inside it.
Every SSH command is gated, with no read and write distinction, because a
shell command is too easy to disguise.
MCP tools skip the gate only when the server itself declares them read only.
Approving
When something is gated you get four choices.
Commands judged dangerous, such as
drop, truncate, grant, rm, dd,
sudo or anything carrying shell metacharacters, are marked Dangerous action,
review carefully and cannot be added to an allow list. They can only ever be
approved one at a time.
An allow list entry is scoped to one chat and one connector. It does not carry
over to another conversation.