> For the complete documentation index, see [llms.txt](https://docs.metacopier.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.metacopier.io/ai/ai/security.md).

# Security and limits

An AI assistant with access to your MetaCopier project is powerful and, for the same reason, worth setting up carefully. This page collects everything that limits what it can do.

***

## The layers

Access is decided by four independent layers. Every one of them can only take away, never add, so the most restrictive layer always wins.

<table><thead><tr><th width="60" align="center">#</th><th width="200">Layer</th><th>Decides</th></tr></thead><tbody><tr><td align="center">1</td><td>The API key</td><td>Which project, read only or read write, and the access policy attached to it</td></tr><tr><td align="center">2</td><td>OAuth scopes</td><td>On an OAuth connection: read, configuration writes, trading writes</td></tr><tr><td align="center">3</td><td>The endpoint</td><td>Which toolsets the assistant can even see, and whether write tools are published at all</td></tr><tr><td align="center">4</td><td>Your client</td><td>Whether it asks you to confirm before a destructive call goes out</td></tr></tbody></table>

Layers 1 to 3 are enforced by MetaCopier. Layer 4 is a convenience of your AI application, so do not build your safety on it alone.

***

## What the assistant can never do

* Reach a project that is not the project of the connection.
* Reach another customer's data.
* Write anything on a read only connection, no matter how it is asked.
* Trade without `mcp:trading.write` on an OAuth connection, even when configuration writes are allowed.
* Write anything on a project with more than 100 accounts, unless we unlocked that project for you.
* Change your billing, your password or your login.
* Keep working after you revoke access. There is no cached credential that outlives it by more than its short lifetime.

***

## Large projects are read only

A project with **more than 100 accounts** only ever gets a read only AI credential. Both write scopes are dropped when the credential is issued, so configuration changes and trades are refused no matter which scopes were approved or which endpoint you use.

The reason is blast radius. A single misread instruction on a project of that size touches hundreds of live accounts at once, and no undo exists for an order that already reached the broker. Reading stays fully available: the assistant can still analyse, report and explain everything.

{% hint style="info" %}
Need writes on a project above the limit? Write to <support@metacopier.io> with your project id and what the assistant is supposed to do. We unlock individual projects after a short look at how the connection will be used.
{% endhint %}

The account count is refreshed at most once a day, so a project that just crossed the limit may keep its write access until the next refresh.

***

## Credentials and lifetimes

<table><thead><tr><th width="200">Mode</th><th width="180">Lifetime</th><th>Notes</th></tr></thead><tbody><tr><td>API key</td><td>Until revoked</td><td>A long lived secret. Treat it like a password.</td></tr><tr><td>OAuth</td><td>60 minutes per credential</td><td>Minted fresh for each request and never handed to the AI application. The application only holds a token that is valid for MetaCopier's MCP server and nothing else.</td></tr></tbody></table>

On OAuth, MetaCopier keeps one key per project called **AI Apps**, created the first time an assistant connects. Every AI connection to that project works through a short lived child of it.

***

## Revoking access

**OAuth.** Remove the connector in your AI application, and revoke the **AI Apps** key of the project in **Projects → API Keys**. Revoking the key cuts off every AI connection to that project at once, including ones you forgot about.

**API key.** Revoke the key in **Projects → API Keys**. The connection stops working immediately.

{% hint style="warning" %}
Revoking **AI Apps** stops all AI access to the project. Any assistant that was connected through OAuth has to be reconnected afterwards.
{% endhint %}

***

## Access policy

An API key can carry an access policy, and everything in it applies to the assistant as well: allowed endpoints, hidden account fields, IP restrictions and CORS origins. On an OAuth connection, the scopes are applied **on top of** the policy of the AI Apps key, so a policy that already blocks an endpoint keeps blocking it.

{% content-ref url="/pages/4TcQLRM0kbdZBZLnhwDE" %}
[Access Policy](/rest-api/access-policy.md)
{% endcontent-ref %}

This is the tool to reach for when you want something more specific than "read only", for example an assistant that may manage copiers but must never see account credentials.

***

## Data and privacy

* The assistant reads only what it asks for, and it can only ask for what the connection allows.
* Everything it reads is sent to the AI provider you chose, because that is where the model runs. Your account names, balances, trade history and logs become part of that conversation. If that matters to you, restrict the fields with an access policy.
* MetaCopier does not send anything to an AI provider on its own. Nothing happens without a request from your client.

***

## A sensible setup

<table><thead><tr><th width="220">Goal</th><th>Setup</th></tr></thead><tbody><tr><td>Trying it out</td><td><code>/p/{projectId}/mcp/readonly</code> with a read only API key, or OAuth with only <code>mcp:read</code> approved</td></tr><tr><td>Everyday questions</td><td><code>/p/{projectId}/mcp</code>, default toolsets, read only</td></tr><tr><td>Managing the setup</td><td><code>/p/{projectId}/mcp/x/accounts,copiers,strategies</code> with <code>mcp:config.write</code></td></tr><tr><td>Trading</td><td>A separate connection on <code>/p/{projectId}/mcp/x/trading</code> with <code>mcp:trading.write</code></td></tr></tbody></table>

Keeping trading on its own connection is the single most useful habit here. A conversation that cannot see the trading tools cannot place an order by accident.