Security
Scopes, tokens, and what the server refuses to do.
The server reaches meeting data only through gateway HTTP routes. It has no side channel into the database or filesystem, so it inherits the Pro license gate and the same per-route scopes as every other Agent API client.
Read-only mode
--read-only is a real guarantee, enforced in two layers:
| Layer | What it does |
|---|---|
| Tool list | Write tools are hidden from the tools the client sees. |
| Tool call | A write tool is refused if called anyway, even by a client that cached an older tool list. |
Both layers matter. The token wired into the server is already scoped, typically Read and Record, so the gateway's own scope check blocks most writes on its own. Read-only mode is a second, independent barrier on top of that: it hides and refuses write tools regardless of what scopes the underlying token carries, which matters if the token was minted with --write.
Webhook tools
The five webhook tools are gated off by default. Start the server with --allow-webhooks to expose them. create_webhook is the only tool that can send data to an arbitrary URL, which is why the whole group is gated rather than left on.
Deletes
The two destructive deletes, deleting a meeting and deleting a pairing, are never registered as tools, in any mode. There is no flag that turns them on.
Scope filtering
The tool list returned to a client is filtered to the calling token's scopes. If that scope check fails, the server falls back to read-only rather than failing open.
When the app isn't running
The tool list still loads from the server's built-in manifest, so a client can see and describe every tool even with the app closed. Calling a tool in that state returns a clear gateway-unreachable error instead of hanging.
The CLI one-command install is scoped by default: it mints a per-client token limited to Read and Record (add --write for Write), and the loopback admin token is only used briefly to authorize that mint, never written into your client config. For an even stricter server, start it with --read-only to hide and refuse write tools entirely. See the limitations page for details.
Last updated on