Skip to main content

​
Access model

Capsulate MCP is not read-only anymore, but the hosted surface is intentionally narrow and deterministic. It now includes selected write flows for:
  • canvas-and-pattern creation in one canonical flow
  • deterministic pattern-definition updates
  • deterministic widget-spec updates
  • version-bound logical-record updates and Undo
  • membership-bound logical-record merge/unmerge and Undo
  • confirmed operational-memory corrections and lifecycle changes
  • confirmed alert creation, editing, and pausing
  • saved external column/finding drafts and publication when contribution tools are deployed
  • optional Capsulate research assignments and lifecycle changes when research tools are deployed
Read scope permits retrieval; writes require mcp:write and the server’s confirmation exchange bound to the exact tool arguments. OAuth consent alone does not approve every write. Preview calls that store contribution or research drafts also require write permission. The host must support this exchange; availability in its tool list does not establish write compatibility.

​
Where it runs

Hosted MCP runs at https://capsulate.app/mcp and uses authenticated Capsulate access.

​
Perimeter protection

The hosted /mcp surface is protected by:
  • OAuth 2.1 with PKCE and tokens bound to the exact MCP resource URL
  • explicit consent showing the client, redirect hostname, and requested permissions
  • least-privilege initial authorization with mcp:read
  • mcp:write enforcement at invocation, with OAuth step-up challenges in the HTTP response and MCP tool-result metadata
  • version-bound record-update previews with atomic apply and conflict-safe undo
  • authoritative membership review plus stale-safe record-grouping apply and undo
  • explicit confirmation inputs for alert mutations
  • invalid browser-Origin rejection and SSRF-safe Client ID Metadata Document retrieval
  • billing gate
  • API limiter
used for the rest of the app API.

​
What gets shared with your AI tool

When you connect an AI tool, it can request whatever the enabled MCP tools expose. Responses may include:
  • Entity fields extracted from messages
  • Source extraction fields and limited email metadata attached to records you explicitly select
  • Canvas and pattern configuration
  • Entity schema and aggregation outputs
  • Canvas briefs, operational memory, cached analyst insights, and bounded read-only query results
  • Saved Canvas Assistant conversation history
  • External findings and internal research evidence, progress, and questions when those tools are available

​
External evidence

External contribution sources and excerpts are supplied by the connected assistant. Capsulate stores them with authenticated OAuth client attribution and does not visit the URLs or verify the claims. Publishing a finding atomically saves its evidence and any proposed cell change. A changed record or schema rejects the save; evidence-only outcomes preserve the cell. A historical receipt records what happened then; read the record again for its current value.

​
Auth and token storage

Hosted MCP clients use OAuth 2.1 with strict S256 PKCE through the normal Capsulate sign-in flow. The first connection requests read access; write access is requested only when needed. The MCP client stores the issued access and refresh tokens. Authorization-code exchange is bound to the client, redirect URI, resource, and PKCE verifier before the code is consumed. Refresh tokens rotate atomically and cannot be reused. Open Settings → Connect AI to review connected clients and revoke a client’s active tokens.

​
Prompt injection and tool safety

Treat any AI tool connection as granting access to whatever the MCP surface can read or mutate. Best practices:
  • Only enable the connector in AI tools you trust.
  • Use record_sources only when you need to verify the provenance of a selected logical record.
  • Review any tool-driven creation or update workflow before relying on the result.
  • If an AI tool’s output looks suspicious, stop and re-check the requested actions.