The main risks
Data MCP is read-only — it can’t change your agents — so the risks are about what data leaves your control and what the model is told to do with it:- Data exposure. Anything pulled into the model’s context can end up in logs or downstream output. Retrieve only what a task needs.
- Prompt injection. The client acting on your behalf is an LLM, and transcript text it reads can contain instructions that try to redirect it. Assume any conversation content the model ingests could attempt to trigger actions you didn’t intend.
Recommendations
Retrieve only what you need
Retrieve only what you need
Don’t pull full transcripts into the model’s context unless you need them — filter to the conversations that matter and request only the fields required. Smaller results keep prompts focused and reduce what’s exposed downstream.
Scope questions to a project
Scope questions to a project
An account API key can query any project in the account. Where a task only concerns one project, pass its
project_id so results — and any data that reaches the model — stay scoped to it. See Authentication.Keep keys out of prompts
Keep keys out of prompts
Store the API key in your client’s secret settings or environment — never paste it into a chat message. Anything typed into the conversation can end up in logs or model context. Rotate a key immediately if it’s exposed.
Treat transcript content as untrusted
Treat transcript content as untrusted
A transcript is user-generated text — it can contain instructions aimed at the model. Don’t let the client act on directions found inside conversation data, and be wary of summaries that quote it verbatim back into a shared channel.
Data MCP can’t create, update, or delete anything — it only reads. To build, test, and deploy agents, that’s the Builder MCP, which has its own security guidance.