AI-Agent MCP Tool-Server Automation: 25 Ways to Read, Zero Ways to Write

The appeal of pointing ChatGPT or another MCP-speaking agent at a company's own dashboard is obvious — ask a plain-language question, get a real number back, no login screen in between. The risk is exactly as obvious once you say it out loud: any door that answers a bearer key instead of a logged-in session is a door that has to get organization scope, write access and error messages right on its own, because there is no browser session, no CSRF token and no human double-checking a form before it submits.

A person using a dashboard through a browser gets scope enforcement, layout that hides what a role can't see, and a session that expires. An agent holding a bearer key gets none of that for free — whatever the server does inside the request handler IS the entire security model. That is exactly why an endpoint like this one earns a stricter default than the rest of the product: off unless someone deliberately turns it on, no write path even as an option, and every trust decision (organization scope, tool permission, anonymity) enforced in code that a test suite checks, not left to the convention of "the frontend wouldn't send that."

Every call to `/api/mcp/v1` is a single POST carrying a JSON-RPC 2.0 envelope; the entire operation surface is the file's own `switch` statement over `method` — `initialize`, `ping`, `tools/list`, `resources/list`, `prompts/list`, and `tools/call` — which means there is no separate URL per operation for anything to scan for a forgotten route. The server checks its own feature flag first, before even reading the request body: if `mcp` is off, it returns 404, deliberately not 403, so a probing request cannot even confirm the endpoint exists. Authentication reads a bearer token, hashes it, and resolves BOTH identity and organization from that hash inside a `security definer` database function — the client never supplies which organization it belongs to, and even if a hostile agent tried, the tool arguments have `organization_id`, `organizacao` and `tenant_id` deleted from them before the tool function ever runs, confirmed directly in the handler's own code with a comment explaining why: "the organization NEVER comes from the agent."

Because a `security definer` function does not inherit the calling user's own row-level security, the team could not simply rely on Postgres RLS the way the rest of the product does for one specific tool: `dash_social_benchmarks`, which returns market percentiles aggregated across multiple companies. Read alone, RLS would have let that function see every organization's data to compute the aggregate — so the k-anonymity check (only return a percentile computed across enough companies that no single one is identifiable from it) had to be re-implemented by hand inside the function itself, and the tool's own description states this in plain language: it "only returns rows that pass Dash's own anonymity criterion," and every row that does come back states how many companies it was computed over, specifically so a percentile from a tiny sample is never mistaken for a real market reference.

The write side is not merely unused — it is empty and tested. `WRITE_TOOLS` is a literal empty array, and a companion test scans every one of the 25 tool names for verbs that suggest changing the world (create, update, delete, pause, resume, publish, send, budget-related terms, and their Portuguese equivalents) and asserts the resulting list is empty. Anything the 8 Maestro tools expose is likewise read-only — pausing a campaign, changing a budget, publishing an ad all still require the Maestro app's own authenticated session, on purpose, so a compromised or over-broad agent key can look at ad performance but can never touch a live budget. When a tool call does fail, the raw error — which might carry a column name, a table name, or a value — is logged server-side only; the agent gets a generic, typed failure code. And a `key.readOnly` scope is enforced independently of what an agent asks for: a test confirms that even listing a hypothetical write tool by name in `allowedTools` does not make it appear for a read-only key.

An agent asks for social-media engagement benchmarks in a niche segment where, this quarter, only two companies in the whole customer base have enough data to compute a percentile. Rather than returning that percentile — which would effectively be describing those two companies' own numbers relabeled as "the market" — the k-anonymity check inside the tool itself withholds that row and the response states, in the same envelope, why: too few companies pass the anonymity threshold this period.

An organization can hand an AI agent real, current numbers about its own funnel, forecast, social performance and model quality without opening a write path, without the agent ever seeing another organization's data, and without a benchmark accidentally exposing one specific company's numbers under a market label. Because the surface is off by default and 404s when disabled, turning it on is a deliberate, visible decision rather than something that happens as a side effect of a deploy.

A team hoping to let an agent pause a campaign, change a budget, or update a deal directly through this server will not find that here — every one of the 25 tools is read-only by design, and operating on Maestro or Orbit data still requires their own authenticated sessions. A team expecting the k-anonymity threshold to be configurable per organization will find a fixed, code-level rule instead — it is not a setting.

Handing an AI agent a generic API key that accepts an `organization_id` parameter trusts the agent, and every piece of code the agent talks to, to always send the right one — one bug, one prompt-injected argument, and that trust boundary is gone. Centriu Dash instead resolves organization scope on the server from the key itself, deletes any organization claim an agent tries to send anyway, and keeps the entire write surface at zero — so the worst a leaked key can do is read that one organization's own numbers, never write to them and never read anyone else's.