Security

MCP tools run inside agent loops, sometimes hundreds of times with no human in the middle. The XreplyAI MCP server is scoped with that in mind.

Everything is scoped to you

Every tool call authenticates as you (API key or OAuth) and every backend query is scoped to your own account. There is no tool that can read or touch another user's data.

Opt-in endpoint surface

API keys work against an allowlist: only endpoints explicitly opted into API-key access are reachable, and everything else returns 403 ENDPOINT_NOT_AVAILABLE. New backend endpoints are unreachable by API keys and MCP until deliberately opted in.

What is deliberately not exposed

These will not appear as MCP tools, by design:

• API keys and provider configuration: a tool that reads credentials is a tool that exfiltrates them
• Session tokens and magic links: the API-key trust boundary stays the only one
• Billing mutations: subscribing, cancelling, and payment methods stay in the dashboard (xreply_billing_status is read-only)
• Identity mutations: email, password, and account deletion stay in the dashboard
• Admin surfaces: no user listings, no support tooling
• Raw archive data: voice profile status is readable; the underlying per-post analysis is not

Destructive tools are guarded

Tools that delete or publish (xreply_posts_delete, xreply_posts_publish) are rate-limited and audited on the backend. Scope your API key to what your agent actually needs. A planning agent does not need publish:write.