Unverified50% confidenceFactExact time
If you do not have permission in the ODC Portal to perform an operation, the equivalent operation through MCP will likewise fail; the Agent does not bypass permissions.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/28/2026
First Seen
Valid until: 1/26/2027
Sources
Related Entities
Related Claims
UnverifiedThe MCP server must treat parameters coming from the Agent as untrusted external input, and must not assume they are safe just because the request comes from its own Agent.71% similarUnverifiedWhen the target service does not provide an API or MCP interface, the Agent can only operate the interface by simulating clicks, and stability and efficiency drop noticeably.71% similarUnverifiedOutSystems MCP performs two checks on each request: operations run as the user's own identity, and the same role-based permissions as in the ODC Portal apply.69% similarUnverifiedThe actual availability of MCP tools depends on account permissions and resource status, and what the Agent can do is ultimately limited by the capabilities the underlying platform exposes.69% similarUnverifiedHaving an Agent bypass the MCP server and access the API directly is essentially reverting the authorization framework to the primitive and dangerous practice of placing long-lived keys in a shell68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1106800API
curl https://kongchang.com/api/v1/knowledge/claims/1106800MCP
get_claim(id=1106800)