MCP can invoke research actions in the desktop process. Treat a client configuration as a permission boundary.
Safe defaults
- Prefer local stdio.
- Keep remote access disabled unless it is required.
- Keep read-only mode enabled where the build exposes it.
- Review tool approval prompts and activity logs.
- Do not publish a session token or local data path.
Remote HTTP or SSE access needs authentication, an allowed origin policy, and transport protection. The desktop runtime contains these controls; their effective values depend on configuration.
MCP does not expose internal Supabase, billing, admin, service-role, or security-operation endpoints as a public API. Those are implementation details of the web and desktop products.