Use a read-only request first. Expand to write scopes only when the assistant
needs to make a specific change.
Last modified on August 29, 2026
Was this page helpful?
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Niblet Docs","description":"Set up Niblet, build 64×32 apps locally, connect the CLI and MCP, and publish apps.","colors":{"primary":"#0D9373","light":"#55D799","dark":"#0D9373"},"logo":{"light":"https://mintcdn.com/niblet/y747dLAb64ljeiwb/logo-light.svg?fit=max\u0026auto=format\u0026n=y747dLAb64ljeiwb\u0026q=85\u0026s=c3aab484e020df576e873b07176c25f0","dark":"https://mintcdn.com/niblet/y747dLAb64ljeiwb/logo-dark.svg?fit=max\u0026auto=format\u0026n=y747dLAb64ljeiwb\u0026q=85\u0026s=dafff4c3f8d61b59a06c4ef0b0765a2d","href":"https://www.heyniblet.com"},"favicon":"https://mintcdn.com/niblet/y747dLAb64ljeiwb/favicon.svg?fit=max\u0026auto=format\u0026n=y747dLAb64ljeiwb\u0026q=85\u0026s=d116ef8db6451bb170463e286b7a30ca","navbar":{"links":[{"href":"https://discord.gg/Ch2yzgf55Z","label":"Join our Discord","type":"discord"},{"href":"https://github.com/heyniblet","type":"github"}],"primary":{"type":"button","label":"Dashboard","href":"https://www.heyniblet.com/dashboard"}},"footer":{"socials":{"instagram":"https://www.instagram.com/heyniblet","reddit":"https://www.reddit.com/r/heyniblet","discord":"https://discord.gg/Ch2yzgf55Z"}},"search":{"prompt":"Search Niblet guides and reference..."},"seo":{"metatags":{"og:site_name":"Niblet Docs","twitter:card":"summary_large_image"},"organization":{"name":"Niblet","url":"https://www.heyniblet.com","logo":"https://www.heyniblet.com/favicon.svg","sameAs":["https://github.com/heyniblet"]},"indexing":"navigable"},"icons":{"library":"lucide"},"styling":{"eyebrows":"breadcrumbs","latex":false},"contextual":{"options":["copy","view","assistant","chatgpt","claude"],"display":"header"},"metadata":{"timestamp":true},"markdown":{"instructions":["Treat Niblet documentation as the source of truth for shipped Niblet behavior.","Keep app source editing, validation, preview, and rendering on the developer's system.","Never ask users to paste credentials, Wi-Fi passwords, OAuth codes, or bearer tokens into chat."]},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"niblet","hasAudioNarration":false,"actualSubdomain":"niblet","customDomains":["docs.heyniblet.com"],"gitSource":{"type":"github","owner":"heyniblet","repo":"niblet-mintlify","deployBranch":"main","contentDirectory":"","isPrivate":true,"mountPath":"","label":""},"chroma":{"latestBuiltDeploymentHistoryId":"6ab5f86007d36642e2a07581","collectionId":"e2e768f8-298c-466a-8475-403c44304bae","liveDeploymentHistoryId":"6ab5f86007d36642e2a07581","schemaVersion":"v3"},"feedback":{"thumbs":true},"entitlements":{"AI_CHAT":{"status":"DISABLED"}},"buildId":"6ab5f86007d36642e2a07581","clientVersion":"0.0.3966","searchFilterCounts":[{"language":"default","tag":"Guides","count":17},{"language":"default","tag":"Developer tools","count":9},{"language":"default","tag":"Build apps","count":6},{"language":"default","tag":"Reference","count":6},{"language":"default","tag":"Niblet MCP","count":5},{"language":"default","tag":"Niblet CLI","count":4},{"language":"default","tag":"App runtime","count":4},{"language":"default","tag":"Set up","count":3},{"language":"default","tag":"Help","count":3},{"language":"default","tag":"Publish","count":3}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true},"hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-v7-file-tree","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"pause-universal-search-reconcile","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"per-site-search-delta","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-private-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-nav-generations","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-agent-model-picker","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"isAtlas":false,"googleFontsInlined":false},"customCss":[{"filePath":"style.css","content":".tidbyt-model-cards [data-component-part=card-image]{aspect-ratio:8/5;object-fit:cover}a[title=\"Join our Discord\"][href=\"https://discord.gg/Ch2yzgf55Z\"]>span+span{display:none}"}],"page":{"pagePath":"mcp/security","slug":"/mcp/security","pageMetadata":{"title":"MCP permissions and security","description":"Understand what you authorize, how Niblet protects each request, and what MCP cannot access.","href":"/mcp/security"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Understand what you authorize, how Niblet protects each request, and what MCP cannot access.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={code:`code`,li:`li`,p:`p`,tbody:`tbody`,td:`td`,th:`th`,thead:`thead`,tr:`tr`,ul:`ul`,..._provideComponents(),...props.components},{Heading,Table,Tip}=_components;if(!Heading)_missingMdxReference(`Heading`,true);if(!Table)_missingMdxReference(`Table`,true);if(!Tip)_missingMdxReference(`Tip`,true);return _jsxs(_Fragment,{children:[_jsx(_components.p,{children:`Niblet MCP uses browser OAuth. Each token is valid only for the Niblet MCP\nendpoint and the permissions shown during authorization.`}),`\n`,_jsx(Heading,{level:`2`,id:`choose-what-the-client-can-access`,children:`Choose what the client can access`}),`\n`,_jsxs(Table,{children:[_jsx(_components.thead,{children:_jsxs(_components.tr,{children:[_jsx(_components.th,{children:`Scope`}),_jsx(_components.th,{children:`Allows`})]})}),_jsxs(_components.tbody,{children:[_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`apps:read`})}),_jsx(_components.td,{children:`Read developer projects and revisions`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`apps:write`})}),_jsx(_components.td,{children:`Create projects and update public metadata`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`submissions:write`})}),_jsx(_components.td,{children:`Submit an uploaded immutable revision`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`displays:read`})}),_jsx(_components.td,{children:`Read displays, catalog data, installations, policies, and scenes`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`displays:write`})}),_jsx(_components.td,{children:`Change display, app, scene, schedule, and firmware state`})]}),_jsxs(_components.tr,{children:[_jsx(_components.td,{children:_jsx(_components.code,{children:`offline_access`})}),_jsx(_components.td,{children:`Maintain the authorized connection with rotating refresh tokens`})]})]})]}),`\n`,_jsx(Heading,{level:`2`,id:`how-niblet-protects-requests`,children:`How Niblet protects requests`}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsx(_components.li,{children:`Tokens must use the Niblet format and target the correct MCP endpoint.`}),`\n`,_jsx(_components.li,{children:`Every tool checks its required OAuth scope.`}),`\n`,_jsx(_components.li,{children:`Account and user identity come from the token, not from tool arguments.`}),`\n`,_jsx(_components.li,{children:`Request bodies and rates are bounded.`}),`\n`,_jsx(_components.li,{children:`Input schemas reject unknown or malformed fields.`}),`\n`,_jsx(_components.li,{children:`Destructive tools require explicit confirmation strings.`}),`\n`,_jsx(_components.li,{children:`Successful changes create account audit events.`}),`\n`,_jsxs(_components.li,{children:[`Responses use `,_jsx(_components.code,{children:`no-store`}),` caching.`]}),`\n`]}),`\n`,_jsx(Heading,{level:`2`,id:`what-mcp-never-receives`,children:`What MCP never receives`}),`\n`,_jsx(_components.p,{children:`Wi-Fi details, physical enrollment values, device credentials, app credentials,\nprovider tokens, Starlark source, local preview files, and publication approval\nremain outside MCP.`}),`\n`,_jsx(Tip,{children:_jsx(_components.p,{children:`Use a read-only request first. Expand to write scopes only when the assistant\nneeds to make a specific change.`})})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"MCP permissions and security","description":"Understand what you authorize, how Niblet protects each request, and what MCP cannot access.","href":"/mcp/security"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[{"title":"Choose what the client can access","slug":"choose-what-the-client-can-access","depth":2,"children":[]},{"title":"How Niblet protects requests","slug":"how-niblet-protects-requests","depth":2,"children":[]},{"title":"What MCP never receives","slug":"what-mcp-never-receives","depth":2,"children":[]}],"codeExamples":{}},"jsLinks":[],"subdomain":"niblet","siteName":"Niblet Docs","title":"MCP permissions and security - Niblet Docs","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-08-29T13:45:31.060Z","gitLastModified":"2026-08-29T13:37:06.000Z","originalFileLocation":"mcp/security.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Understand what you authorize, how Niblet protects each request, and what MCP cannot access.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Niblet Docs\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"MCP permissions and security - Niblet Docs\">\u003cmeta data-mint-head property=\"og:description\" content=\"Understand what you authorize, how Niblet protects each request, and what MCP cannot access.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Niblet Docs\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.heyniblet.com/mcp/security\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://niblet.mintlify.app/_mintlify/api/og/v2?division=Niblet+MCP\u0026amp;title=MCP+permissions+and+security\u0026amp;description=Understand+what+you+authorize%2C+how+Niblet+protects+each+request%2C+and+what+MCP+cannot+access.\u0026amp;theme=6a89cdeae9dc16f652461618\u0026amp;signature=f77115cd94bbbf504d68fa42cca368f3b4cb9fd54857e324c96b698acbc44e8d\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"MCP permissions and security - Niblet Docs\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Understand what you authorize, how Niblet protects each request, and what MCP cannot access.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://niblet.mintlify.app/_mintlify/api/og/v2?division=Niblet+MCP\u0026amp;title=MCP+permissions+and+security\u0026amp;description=Understand+what+you+authorize%2C+how+Niblet+protects+each+request%2C+and+what+MCP+cannot+access.\u0026amp;theme=6a89cdeae9dc16f652461618\u0026amp;signature=f77115cd94bbbf504d68fa42cca368f3b4cb9fd54857e324c96b698acbc44e8d\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/niblet/VcbLmH71GYgc0zDw/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Niblet Docs\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#0D9373\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.heyniblet.com/mcp/security\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/mcp/security.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://www.heyniblet.com/#organization\",\"name\":\"Niblet\",\"url\":\"https://www.heyniblet.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://www.heyniblet.com/favicon.svg\"},\"sameAs\":[\"https://github.com/heyniblet\"]},{\"@type\":\"WebSite\",\"@id\":\"https://docs.heyniblet.com#website\",\"name\":\"Niblet Docs\",\"url\":\"https://docs.heyniblet.com\",\"publisher\":{\"@id\":\"https://www.heyniblet.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.heyniblet.com/mcp/security#webpage\",\"url\":\"https://docs.heyniblet.com/mcp/security\",\"name\":\"MCP permissions and security\",\"description\":\"Understand what you authorize, how Niblet protects each request, and what MCP cannot access.\",\"dateModified\":\"2026-08-29T13:37:06.000Z\",\"isPartOf\":{\"@id\":\"https://docs.heyniblet.com#website\"},\"breadcrumb\":{\"@id\":\"https://docs.heyniblet.com/mcp/security#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.heyniblet.com/mcp/security#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Niblet MCP\",\"item\":\"https://docs.heyniblet.com/mcp/overview\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"MCP permissions and security\",\"item\":\"https://docs.heyniblet.com/mcp/security\"}]},{\"@type\":[\"Article\",\"TechArticle\"],\"@id\":\"https://docs.heyniblet.com/mcp/security#article\",\"headline\":\"MCP permissions and security\",\"name\":\"MCP permissions and security\",\"description\":\"Understand what you authorize, how Niblet protects each request, and what MCP cannot access.\",\"url\":\"https://docs.heyniblet.com/mcp/security\",\"mainEntityOfPage\":{\"@id\":\"https://docs.heyniblet.com/mcp/security#webpage\"},\"dateModified\":\"2026-08-29T13:37:06.000Z\",\"publisher\":{\"@id\":\"https://www.heyniblet.com/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.heyniblet.com#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Niblet Docs\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Niblet Docs","nav":{"global":null,"tabs":[{"tab":"Guides","icon":"book-open","pages":[{"title":"Guides","href":""}]},{"tab":"Developer tools","icon":"terminal","groups":[{"group":"Niblet CLI","pages":[{"title":"CLI overview","href":"/cli/overview"},{"title":"Sign in from the CLI","href":"/cli/authentication"},{"title":"Build, install and update an app","href":"/cli/app-workflow"},{"title":"CLI commands","href":"/cli/commands"}]},{"group":"Niblet MCP","pages":[{"title":"MCP overview","href":"/mcp/overview"},{"title":"Connect your AI client","href":"/mcp/connect"},{"title":"Control your displays","href":"/mcp/display-control"},{"title":"Manage app records","description":"Create projects, update listing copy, inspect revisions, and submit a CLI-uploaded app.","href":"/mcp/developer-apps"},{"title":"MCP permissions and security","href":"/mcp/security"}]}]},{"tab":"Reference","icon":"braces","pages":[{"title":"Reference","href":"/reference/widgets"}]}]},"title":"MCP permissions and security - Niblet Docs","buildId":"dpl_cadrRc5H9XQiJQbDFN5mcYRs2PAj","deploymentId":"dpl_cadrRc5H9XQiJQbDFN5mcYRs2PAj","dynamics":[],"chunks":[]}
