AI agents (MCP)
Is it safe? Permissions and limits
Giving an AI assistant access to your website is a reasonable thing to be careful about. This page answers the questions people actually ask, with the real boundaries rather than reassurance.
The short version: an agent acts as you, and only as you, every single request is checked against your own permissions, it cannot move money, and you can cut it off in one click.
Can it reach sites that are not mine?
No.
Every request an agent makes names a specific site or page, and every request is checked against your permissions at the moment it runs. There is no "currently selected site" that could drift, and no elevated mode. If you can edit it in the editor, the agent can edit it; if you cannot, neither can it.
That check happens per request, not once at connection time. Remove someone's access to a site and their agent loses it on its next request.
Two related details worth knowing:
- Ids cannot be probed. Asking for a site that does not exist and asking for someone else's site produce exactly the same answer, so an agent cannot use the difference to discover what exists.
- Being an administrator changes nothing here. The elevated view that platform administrators get inside the browser does not extend to this connection. Over MCP, an admin sees their own sites like everyone else.
Can I give it read-only access?
Yes, if you connect with a token — choose Read-only when you create it. See Connect VS Code and CLI agents.
Read-only means the editing tools are never offered to the agent in the first place, and are refused again if one is somehow called anyway. It cannot write by accident and it cannot be talked into writing.
This is a good way to start: connect read-only, ask the agent to describe your site, see whether you like how it reasons, then upgrade.
Signing in through Claude or ChatGPT grants read-and-write access. If you want read-only, use a token.
Can it delete things without asking?
Deleting a page, removing a section, or replacing your brand settings are marked as destructive, and AI apps prompt you before running anything marked that way.
That confirmation belongs to your AI app, not to us — which is worth knowing because of one confusing message. If you see "No approval received", the request never reached PageWebPro and nothing was changed. The confirmation was declined or timed out. Approve it and ask again.
More generally: pages are versioned. Every change an agent makes is stored as a revision you can look at and roll back, exactly like your own edits.
Can it spend money, or see customer payment details?
No. Money never moves through this connection. There are no tools for it — not restricted tools, no tools at all.
An agent cannot:
- take a payment, issue a refund, or record one manually
- change payment settings or connect a payment provider
- see a customer's checkout link
- read a ticket code — the code is the door, so it is never returned, and it cannot be searched on either
- see a booking's manage-and-cancel link, or a customer's file download link
The one cancellation it can do is cancelling an order that has not been paid for. Anything involving real money stays in the owner interface where you can see what you are doing.
What about my customers' personal data?
Lists are deliberately thin. Asking for bookings, orders or attendees returns names and statuses — enough to work with, enough to report on.
Email addresses, phone numbers, postal addresses, notes and booking answers only appear when the agent asks for one specific record. So "how many bookings this week" never pulls your customer list into a chat, while "what's the email for booking 412" still works when you need it.
Can I see what it did?
Yes, and this is worth checking after your first real session.
- Every page edit is a revision, attributed to the agent rather than to a browser session. You can see them in the editor's version history and roll back.
- Custom code changes are versioned the same way.
- Comments an agent leaves appear in the editor's Comments panel with a badge marking them as agent-written.
- If you have the editor open while an agent works, the page updates live in front of you. Watching the first few edits happen is the fastest way to build trust in it.
- Each token shows when it was last used, and each connected app shows when you authorized it.
One thing to be aware of: there is no locking. If you and an agent edit the same page at the same moment, the last save wins — the same as two people in the editor. Let it finish a page before you start editing that page.
How do I stop it?
Account → Settings → Connected AI agents → Change, then Revoke — either on the connected app, or on the token. It takes effect on the agent's next request.
Removing the connector inside Claude or ChatGPT is not the same thing: it tidies your AI app's settings but leaves the permission alive. Revoke here.
You can also limit exposure up front: give tokens an expiry (1–365 days), and make one token per place it will live so you can revoke precisely.
Other limits worth knowing
- Rate limit — 60 requests a minute per account. A long build slows down rather than failing; a runaway loop cannot hammer the site.
- Uploads — 8 MB per file. Larger assets go through the editor.
- No fetching from the web. An agent cannot ask the server to download a URL. Images are uploaded as data by the agent itself.
- Domains stay manual. No agent can attach a domain to a site. Pointing a real domain at a site is a decision left with a human.
- Custom code is not filtered. If you ask an agent to add tracking code or custom HTML, it goes in as written — the same as pasting it into the editor yourself. Review what it writes.
For administrators
- The whole MCP surface has a platform kill-switch. Turned off, every request fails immediately, including sign-ins — see Admin → Settings.
- Bookings, store and forms each have their own platform and per-space toggles. An agent working on a space where a module is off gets a clear message saying so.
- Ids are only valid on the installation that issued them, and every tool an agent sees is labelled with the installation name. Someone connected to two installations at once cannot silently mix them up.