Security and limits
Who it acts as
Section titled “Who it acts as”Every call runs as the person who connected the assistant. Foldr’s share permissions, field permissions and governance rules apply to every call as they apply to that person on the web. There is no shared service account and no way to act as someone else.
A site’s data stays in its site. A token made for one site is refused at any other.
What is recorded
Section titled “What is recorded”Every tool call writes one Activity row (unless that activity type is switched off for the site), Used a Foldr tool from a connected AI app, as the person, naming the app. A file tool’s row also records the share and path as the assistant gave them, and a search records its query. A write tool’s row also records the names and targets the call gave (such as a new name, a destination, a field or a permission), each cut to 500 characters. The row never holds file contents, recipient lists or messages. Foldr skips an activity type an administrator has switched off for the site, so a call can leave no row.
Connecting and disconnecting an app write their own rows under Connected apps. Changes an assistant makes through the write tools appear in Activity as they do for any change, marked as made through the MCP server.
Limits
Section titled “Limits”| Limit | Value |
|---|---|
Requests to /mcp | 240 a minute for each person from each source address, shared by the apps that person uses from that address |
| One result | 64 KB. A longer result is cut with a note saying so |
| Self-registration | 30 an hour from one address, per site, and 100 attempts a day for the site (failed attempts count) |
| Access token | One hour, renewed by the app |
| Connection | Up to 90 days, ends after 30 days unused (administrator can change) |
| Write calls | An optional daily limit per person per app, set in the app’s policy |
Writes
Section titled “Writes”- A write tool works only where the app’s policy allows: the scope, and the shares named in the policy.
- A sharing request is always held for an approver. The approver sees “Requested through the connected app (name)”. Nothing is shared and no link is returned until they approve. If nobody can approve, the request is refused and nothing is created.
- An app may only start sharing an item. It cannot change a link that already exists.
- An append to a file takes a short lock on the file. If someone else is changing it, the tool says so and the assistant can try again.
What leaves Foldr
Section titled “What leaves Foldr”What a tool returns goes to the assistant’s provider, because that is how the assistant answers you. Foldr applies its own redaction rules to a result, and fences text that came from a file so an assistant can tell file contents from instructions. Decide which assistants your organisation lets people connect. The approval switch in Turn it on is the control for that.
A result never contains Foldr’s internal names. A file’s own text is returned as the file holds it.
Errors
Section titled “Errors”Sign-in and token failures give one answer, a bare 401, whatever the reason. The server does not say whether the feature is off, the app is unapproved or the person is disabled. When connected apps are off, the address answers 404.