Review MCP access and changes

MCP brings external capabilities into Ghast and can send conversation data and tool parameters to an external server. Review four layers: plugin or configuration provenance, server process or domain, connected account and scopes, and the real side effect of each tool.

Before connecting

Local stdio

• Who publishes the program or package?
• Is the command pinned to a version?
• What files can its working directory and arguments reach?
• Which credentials are passed in the environment?
• Does it need network access, and what leaves the machine?
• Can child processes or external state remain after Ghast stops?

Remote MCP

• Is the URL an official HTTPS domain?
• Which account and organization are you signing into?
• Which OAuth scopes are requested?
• What access and lifetime does a header token have?
• Does the service retain inputs, outputs, or file content?
• How do you disconnect and revoke remotely?

Never put credentials in a chat message, skill, plugin description, screenshot, or log. Prefer OAuth or a plugin credential vault. Custom MCP environment and Header fields are plain text and show existing values during editing; do not open them while screen sharing or recording.

Review tools by side effect

Class	Examples	Minimum check
Read	Search, list, get details	Account, workspace, time range, and pagination completeness.
Create	New document, issue, or task	Title, location, visibility, default members, and duplicate risk.
Update	Change a record, status, or permissions	Target ID, old and new values, and concurrent overwrite risk.
Send / publish	Email, message, comment, or public content	Recipient, channel, final body, attachments, and audience.
Delete / revoke	Delete a file, cancel an event, revoke access	Recoverability, affected objects, related data, and alternatives.
Funds / trading	Order, payment, or transfer	Network, asset, amount, fees, slippage, destination, and receipt.

For a new server, enable only the necessary tools and start read-only. Before a high-risk call, require explicit parameters; afterward, verify the destination state.

Review changed tool descriptors

An upgraded MCP server can change a tool description or input schema. When Ghast detects a material change, it pauses that tool for review:

1. open Plugins → Manage connections;
2. find the tool-change alert;
3. choose Review;
4. compare the before and after description or input schema;
5. approve only after confirming the meaning, parameters, and side effects.

Approval accepts that descriptor version. It is not permanent authorization for every future call. Tool selection, command approval, and remote permissions still apply separately.

OAuth and tokens

• Prefer OAuth over a manual long-lived token when scopes and revocation are clearer.
• Verify the provider domain in the browser.
• Use different connection names for test and production accounts.
• After disconnecting in Ghast, follow the UI guidance and inspect remote account authorizations.
• On suspected exposure, revoke or rotate at the provider first, then update Ghast.

Connected does not mean every scope was tested. Confirm identity and data range with a read-only tool before writing.

Resource data boundaries

Resources come from the server and can contain documents, database records, or files. Opening a resource displays it in Ghast; using it in a conversation may send it onward to the selected model provider.

Before reading or using one, confirm:

• server and account ownership;
• personal data, customer data, and internal links;
• whether the selected model provider may receive it;
• whether a smaller excerpt is sufficient.

Read connection diagnostics

A card can show Failed connection or Limited connection. Preserve the full error and locate the failing layer:

• command missing or process exited: local runtime or arguments;
• DNS, TLS, or timeout: network, proxy, or URL;
• 401, unauthorized, or missing credential: OAuth or token;
• protocol or handshake error: endpoint or transport;
• tool unavailable: capability discovery or descriptor review;
• call returned but business action failed: tool parameters or service rules.

Do not “fix” an unknown failure by hiding the error, switching to Full access, or broadening token scopes. Identify the layer, then change the minimum necessary setting.

Disconnect, delete, and revoke

These are different actions, and they do not share one UI:

• Disconnect is available for Plugin Connections in Manage connections; a custom MCP Server currently has no matching OAuth disconnect action;
• Delete server removes a custom Ghast configuration;
• Remote revoke invalidates the token or OAuth grant at the provider.

To fully end access, disconnect a Plugin Connection in Ghast and revoke it at the provider; for a custom MCP Server, delete its configuration and revoke at the provider. Data already created or changed by a tool is not automatically rolled back.

Pre-production checklist

• Provenance, publisher, version, and integrity are verifiable.
• The intended test or production account is connected.
• OAuth scopes or token permissions are minimal.
• Tool names, descriptions, and input schemas were reviewed.
• Resources contain no data that the model provider must not receive.
• A read-only call confirmed identity and scope.
• Write actions have explicit parameters and acceptance evidence.
• Disconnect, revocation, and rollback paths are recorded.
• Logs and screenshots do not expose credentials or customer data.