> For the complete documentation index, see [llms.txt](https://docs.dapta.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dapta.ai/dapta-mcp/safety-and-security.md).

# Safety & Security

How the Dapta MCP keeps your data safe: workspace isolation, preview then commit on every change, keys that stay on the server, redacted flow credentials, revocable keys and logins, and tool hints.

The Dapta MCP is built so you can hand it to an AI client without worrying about surprise changes or cross-workspace leaks.

***

## Workspace isolation

Every call is scoped to one workspace: the one tied to your API key, or the one you chose after signing in. Resources from another workspace are refused with a clear message.

***

## Preview, then commit on every change

No update, delete, publish or run happens without a preview you can read first. The preview shows exactly what will change and returns a single-use token. **Nothing is written until you approve the change in the conversation and the matching commit runs.**

{% hint style="info" %}
Four tools act without a preview. `create_voice_agent` creates a brand-new voice agent once you have confirmed the details, and changes nothing that already exists. `discard_text_agent_draft` drops a text agent draft that was never published. `chat_with_text_agent` runs a test conversation; the agent's own tools run for real during it. `generate_text_agent_example_questions` suggests three starter questions for a text agent and does not save them to the agent.
{% endhint %}

***

## What stays on the server

Your Dapta API key, your login session and your agents' secret keys are never returned to Claude.

### Credentials inside your flows

Credentials you saved inside a flow step for your own external systems, such as an authorization token, a password or an API key in a header, are redacted. When Claude reads a flow, a step, a flow version or a template, each of those values comes back as `«redacted»`, while the rest of the step stays visible.

* **Editing keeps them.** When Claude changes a step and sends a credential back as `«redacted»`, Dapta keeps the value you stored.
* **You can rotate them from the chat.** If you give Claude a new token, it sends the new value and it replaces the stored one. The old value is never shown.
* **They stay where they are.** A stored credential cannot be copied into a new step, and it is not kept if the step now sends it to a different host. In those cases the preview is refused and names the step and field, so you can provide the value.

A flow's webhook URL is different: it includes that flow's own key, because that is the address an agent or a script uses to run the flow. To see or change a step's credentials yourself, open the step in Flow Studio.

***

## Keys and logins you can revoke

* **Keys are shown once.** Treat a key like a password. If it is exposed, revoke it and create a new one. Revoking a key does not affect your other keys.
* **Logins can be revoked** from your Dapta account settings, or by removing the Dapta connector or app from your AI client.
* **Sign-in is limited to owners and admins.** A login reaches only the workspaces where you are an owner or admin.
* **A login acts as you.** What Claude does through a login is recorded under the person who signed in, and a preview made through a login can only be confirmed by that same person.

***

## Usage limits

| Limit                                                                    | Value                      |
| ------------------------------------------------------------------------ | -------------------------- |
| Tool calls per key or per login                                          | 60 per minute              |
| Heavy analytics calls (heatmaps, variable analysis, flow run statistics) | 100 per hour per workspace |
| Active API keys                                                          | 10 per workspace           |

***

## Tool hints

Every tool has a title and declares whether it only reads or can change data. Every tool that writes is marked as destructive, including the ones that only create something new, so your AI client knows to ask before running it. Tools that can act beyond your workspace data are also flagged as reaching outside Dapta: running a flow, adding contacts to a calling sequence, moving CRM contacts into a pipeline stage that is linked to a sequence, or creating, changing, publishing or deleting an agent that talks to real people.

| Kind of tool       | Count | What it means                                                                                          |
| ------------------ | ----- | ------------------------------------------------------------------------------------------------------ |
| Read-only          | 123   | Returns data. Changes nothing. Includes every `preview_*` tool                                         |
| Write that creates | 11    | Creates something new. Changes nothing that exists                                                     |
| Write that changes | 22    | Changes or removes existing data, or can overwrite it, such as adding rows that replace a matching row |

All writes go through a preview except the four listed above.

***

## Related

{% content-ref url="/pages/LRJbKEAV5HB4G9Q0Ww1G" %}
[Key Concepts](/dapta-mcp/key-concepts.md)
{% endcontent-ref %}

{% content-ref url="/pages/798dogc3L39Nv9w4fDCI" %}
[Tools Reference](/dapta-mcp/tools-reference.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.dapta.ai/dapta-mcp/safety-and-security.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.