MCP Permissions and Security
Learn how to keep your Zuro account secure when using MCP and understand what permissions your AI assistant needs.
Understanding Permissions
MCP uses permissions to control what your AI assistant can do. You choose which permissions to grant when creating an MCP key.
Available Permissions
Article Permissions
- Read - View and list articles
- Write - Create and update articles
- Delete - Delete articles
Knowledge Base Permissions
- Read - View knowledge base information
- Write - Create and update knowledge bases
- Delete - Delete knowledge bases
Other Permissions
- Analytics - View analytics data
- Comments - Read and moderate comments
- Search - Search across knowledge bases
Permission Best Practices
Only Grant What You Need
For content creation:
- Articles: Read + Write
- Knowledge Bases: Read
- Search: Read
For analytics only:
- Articles: Read
- Knowledge Bases: Read
- Analytics: Read
For full management:
- Grant all permissions you need
- Only add delete permissions if necessary
Keeping Your Keys Secure
Creating Keys
- Use descriptive names - "Claude Desktop - Personal" or "Cursor IDE - Work"
- Create separate keys - Use different keys for different assistants
- Store securely - Never share keys or commit them to code repositories
Key Security
- One-time display - Keys are only shown once when created
- Immediate revocation - Deleted keys stop working immediately
- Secure storage - Store keys in password managers or secure notes
Key Rotation
- Rotate regularly - Delete old keys and create new ones periodically
- After incidents - Rotate keys immediately if compromised
- When sharing stops - Rotate keys when team members leave
Security Best Practices
- Strong passwords - Use a strong password for your Zuro account
- Monitor usage - Check when keys were last used in settings
- Review permissions - Periodically review what permissions you've granted
- Minimal permissions - Only grant what you actually need
- Separate keys - Use different keys for different assistants
Rate Limits
MCP requests are limited to prevent abuse:
- Professional Plan: 1,000 requests/hour per key
- Enterprise Plan: 5,000 requests/hour per key
If you hit the limit, wait a bit and try again, or upgrade to Enterprise for higher limits.
What's Logged
- All MCP operations are logged
- Key usage (last used date and count)
- Errors and failed operations
- Logs are kept for 90 days
If Your Key Is Compromised
- Delete the key immediately - Revoke access right away
- Create a new key - Generate a replacement
- Update configurations - Update all your AI assistant configs
- Review activity - Check logs for unauthorized access
- Contact support - Report security incidents