Skip to main content

Security and permissions

The token is your identity​

A personal access token acts as you: it sees your workspaces and carries your roles in them. The agent has your permissions, nothing more — every tool call runs the same permission checks as the app. Anyone holding the token can act as you in WriteMars, so treat it like a password.

Token management itself requires a browser session — a token cannot mint or revoke tokens. The MCP server accepts personal access tokens only; app session tokens are deliberately not accepted.

Confine the agent with workspace scoping​

A token can be scoped to a single workspace at creation — requests to other workspaces return 403. That's the safer default for agents: the agent can't even list workspaces outside the scope, let alone touch them.

Publishing only happens when you ask​

The server instructs agents to call publish_variant only when you explicitly ask to publish. The tool's own description tells the agent: "This posts publicly on the user's behalf — only call it when explicitly asked to publish." Drafting, editing, and scheduling never post anything immediately — scheduled variants go out via WriteMars's scheduler at the time you set, which you can undo right up until then.

Approvals are enforced, not bypassed​

Permissions are checked server-side in the same code paths the app uses, so an agent hits exactly the same walls — there's nothing extra to configure. On a channel that requires sign-off, publish_variant doesn't error and doesn't post: it returns the variant with status needs_approval and an approval_note, and the channel's approvers are notified. See approvals.

Resolving approvals through MCP enforces the same eligibility rules as the app: a peer review can only be resolved by its assigned reviewer, and a channel approval only by the channel's owner, their trusted members, or admins (company channels only). Every resolution is attributed to the token's user and logged in the post's activity — the agent approving is you approving, on the record.

Visibility is enforced too​

Agents see what you see. Private posts outside your audience are excluded from list_posts and return not-found from get_post, and list_social_profiles only returns the accounts you can see. Any account you assign to a variant is re-checked against your channel access before a schedule lands or a publish goes out.

Every action runs as you​

Every tool runs with your user identity; there is no separate "agent" identity to hide behind. Post/content actions use the same activity log, approval, and notification paths as the app.

Rate limiting applies​

Requests are rate-limited per token (120/minute). A long agent session may briefly pause and retry; that's normal, and it caps how much damage a runaway loop can do.

Token hygiene​

  • Treat tokens like passwords. Revoke immediately if leaked (Profile → API Tokens); revocation is immediate — the next request with that token gets 401.
  • Never put a token in a URL — URLs end up in logs. Headers only.
  • One token per integration. When something only needs one workspace, scope it. Prefer workspace-scoped tokens with an expiry for CI and third-party integrations.
  • The Last used column on the tokens page tells you which tokens are actually in use (updated at most every few minutes).