Skip to main content
Every credential on this surface, however it authenticated, is clamped to read plus safe writes. The clamp is enforced on the server for each request, so it holds identically over MCP and over plain HTTP.

​
Never available

  • Sending anything to an external platform. Nothing you do here reaches a customer or appears in public: not a reply to a review or a mention, and nothing on any connected channel.
  • Triggering a sync or an AI Visibility run. These are platform-admin actions; the schedulers keep data fresh for everyone else, and get_active_syncs tells you whether a refresh is in flight.
  • Billing, users, and minting, rotating or revoking credentials.
  • Writing entities directly. Entity writes are refused for every entity. All changes go through named operations.
Drafting is available and sending is not, which is the line the whole surface is drawn on. An assistant can write the reply; a human reads it, and sends it.

​
The two calls that change something a human notices

apply_tracking_setup

Creates the starter trackers and prompts. Fills empty capacity only, never overwrites existing rows, and caps are enforced server-side.

mark_leads_seen

Marks specific leads triaged. Idempotent, first-seen wins, and unknown ids are skipped rather than erroring.
Everything else either reads, or produces a draft that sits in the app until a person acts on it.

​
Data that is never readable

Two exclusions are worth naming, because they are not oversights:
  • Agency records. Reading one decrypts stored secrets, so the entity is blocked outright.
  • Raw AI-traffic events. The per-hit stream is high volume and visitor-level. The daily rollup answers the question the feature exists to answer, and that is what is exposed.

​
Why it is an allow-list

The readable entities and callable operations are enumerated, never derived by subtracting a blocklist. A new endpoint that nobody has classified therefore fails closed: it is refused until someone deliberately adds it. A forgotten entry costs you a 403 and a bug report. The other way round, it would cost a silent hole. This is also why these docs are generated from those same lists. If something is documented here, a credential can call it; if it is missing, it does not exist.