MCP Security

6 min read

Read Only

The MCP server exposes no tool that creates, edits, deletes, executes or imports anything. This is not a permission you could grant by accident — no such tool is registered, and an automated check fails the build if one is ever added that borrows a write permission.

The strongest practical consequence: a connected AI cannot damage your data, whatever it is asked to do or told to do by something it reads.

Permissions Are Yours

A connection reads exactly what the credential behind it reads, resolved fresh on every request against your current memberships.

Remove someone from a project, and their connected clients lose it on the next call.
A role that cannot open the Defects screen cannot read defects over MCP.
Nothing is cached into the credential at the moment you connect, so a grant cannot outlive the access it was made against.

Prompt Injection

Records contain text people wrote — test case steps, defect descriptions, comments. An AI reading them may encounter instructions embedded in that text.

This is worth understanding rather than worrying about: because every tool is a read, the worst an injected instruction can achieve through Hawzu is to make the AI query something else and report it back to you. It cannot change your data.

It can, however, influence what the AI tells you. Treat an AI’s summary of your test data the way you would treat a colleague’s — useful, and worth checking before you act on it.

MCP Tokens Are Separate

An access token is created for one purpose or the other, chosen at creation and not changeable afterwards.

A token created for the REST API is refused on /mcp.
A token created for MCP is refused everywhere else.

This is deliberate in both directions. A token issued months ago for a CI job carries a role chosen for posting build results — it should not quietly become a way to hand a whole project’s records to an AI client, which is not what the person who issued it reviewed it for. And an MCP token is the credential that gets pasted into third-party AI clients, which is the least controlled place any Hawzu credential goes; confining it to one read-only endpoint keeps that exposure small.

Changing what a token is for means creating a new one and revoking the old.

Choosing a Connection Method

An MCP access token reads every project in the workspace it was created in, and nothing anywhere else. There is no role or project to choose — an MCP token holds one permission, mcp_read, which exists only for this purpose and cannot be given to a person or added to a custom role.

Its reach is worked out on each request rather than fixed at creation, so a project added to the workspace later is readable straight away, with nothing done to the token. It does not expire unless you gave it an expiry, so it is the credential to be careful with.

MCP tokens are revoked, not disabled — there is no disabled state. Revoking one takes effect on its next call.

Signing in creates a credential that acts as you in one workspace, expires hourly and refreshes silently. You can revoke it, and so can an administrator of that workspace. It is the safer default where the client supports it.

Any application can call itself anything. Registration is open, because that is how Claude and ChatGPT connect without a human in the loop — which means the name on the screen is a claim, not an identity.

You also choose which workspace the connection is for. That choice is required, and it is enforced: the application can read that workspace and no other. To connect the same application to a second workspace, authorise it again from there — that is a separate connection, revocable separately.

Reviewing and Revoking Access

Connections appear in two places, and they answer different questions.

Workspace administrators — workspace Settings → Security → Connected apps lists every member’s connections to that workspace: which AI clients can read it, and whose account each is using. Managers and coordinators can disconnect any of them, the same roles that manage access tokens.

Each member — personal Settings → Security → Connected apps lists what they have connected, across every workspace. It stays available to them whatever their role in those workspaces becomes, because a connection acts as them and is theirs to withdraw.

Open the relevant Connected apps list.
Find the application and choose the disconnect action.
Confirm.

Revocation takes effect on the client’s next call, not at the end of the hour its credential had left. Disconnecting one workspace’s connection leaves the same application connected to any other workspace it was separately authorised for.

To revoke an access token instead, use the Access Tokens page. See Manage access tokens. That cuts off every client using that token.

Rate Limits

The MCP endpoint is rate limited per credential: 120 units per rolling minute, where a query or a release-readiness call costs 4, describing a project costs 2, and everything else costs 1. That is roughly thirty real queries a minute — far more than a person asks through an agent, and far less than a runaway loop needs. An AI in a loop is stopped within a minute rather than left to run.

The limit is a tool refusal rather than an HTTP error, so the client’s model reads you are looping, stop and can act on it, instead of the message being swallowed by its retry logic.

If a client reports being rate limited, it is usually looping — asking the same thing repeatedly rather than narrowing one query.

What Is Logged

The question is kept. The answer is not.

Every call an AI client makes is recorded — which tool it used and what it asked for. Nothing that comes back is recorded: not the rows, not the records, not their contents. Hawzu keeps no copy of the test data an AI reads through MCP.

Alongside each call we keep a short summary: the tool, whether it succeeded or was refused, how many rows it returned, how long it took, and — for a sign-in connection — which application asked. That last one is recorded nowhere else: a sign-in connection acts as the person, so every other log names them rather than the agent working on their behalf. The summary holds no arguments and no record content at all.

Refused calls are recorded too, and that is the point of them. A revoked token being retried, or a client repeatedly asking for something its role cannot read, is visible rather than silent.

This record is available to Hawzu’s own operators for support and investigation. It is not shown on the workspace Connected apps page, and it is not an audit log entry — audit logs record changes, and every MCP call is a read. Connected apps tells you which clients are connected; see Reviewing and revoking access to disconnect one.