Unverified50% confidenceFactExact time
OutSystems MCP performs two checks on each request: operations run as the user's own identity, and the same role-based permissions as in the ODC Portal apply.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/28/2026
First Seen
Valid until: 1/26/2027
Sources
Related Entities
Related Claims
UnverifiedMCP Servers usually run as the user and obtain the same credentials as the user (local file system access, API keys, OAuth tokens), so a malicious or vulnerable Server could in theory read anything within its authorized scope.74% similarUnverifiedOmni MCP performs permission checks at the gateway layer, where the gateway verifies whether the caller has permission when a tool is actually invoked.72% similarUnverifiedIn the MCP architecture, the Agent only forwards invocation requests to the server, and the server executes I/O and side effects, so permissions, auditing, and sandboxing can all be handled uniformly on the server side.70% similarUnverifiedWhen evaluating an MCP integration, one must confirm that permission checks occur on the server side in the context of each retrieval request, rather than relying solely on identity verification at connection initialization.70% similarUnverifiedA local MCP server is launched by the Agent under the user's account and has the same permissions as the user, able to open any file and run any program.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1106799API
curl https://kongchang.com/api/v1/knowledge/claims/1106799MCP
get_claim(id=1106799)