History and safety

A connected assistant can do real work on your account, so it helps to know its limits and how to check up on it. By the end of this page you will know what it can never do, where to see everything it did, which requests deserve a second look before you say yes, and how to disconnect it.

It acts as you, with your permissions only

The assistant signs in as you. It can reach exactly what you can reach — your labs, your domains, your organizations where your role allows — and it is refused exactly what you are refused. It does not see your password.

Two consequences:

• It is as powerful as you are. If you can stop a lab or drop a database, so can it.
• It cannot borrow anyone else's power. Pasting someone's session, token or key into the chat does not help: a request that carries a credential of its own is refused without running. Whatever you were trying to reach that way is done in the web dashboard.

Approve only clients you started yourself

Signing a client in ends with an approval screen naming it. If one appears that you did not trigger just now, deny it. An approved client can act as you until you disconnect it.

What it cannot do

It cannot…	What happens if you ask
Handle billing or change your plan	There is no tool for it. Use the dashboard or ask your administrator.
Do anything outside labs and their resources	Refused as policy, the same for everyone including administrators.
Reach labs outside its lab list	Refused, whether named by name or by id. Manage those in the dashboard.
Use tools your plan does not include	They do not appear in your client at all. See What your plan allows.
Read anyone else's history	Your history shows your account only — for administrators too.

Refusals that are final

Some refusals are answers, not glitches. Retrying, rephrasing or trying a different id does not change them, and a good assistant tells you so and stops:

• "Not one of the labs available" — the lab is outside its reach.
• "A deploy is already in progress for this lab" — wait for it to finish.
• "Copy limit reached" — your plan's copy limit. Terminate a copy first.
• "You do not have enough Jolt" — nothing was spent. Redeploy instead; it resets the expiry for free.
• "This certificate cannot be re-issued" — it is healthy and will renew by itself.
• "Upgrade your plan to add custom domains" — your own domains need a paid plan.

If an assistant keeps retrying one of these, stop it and ask what the message said.

Everything is recorded

Every call a client makes on your account is recorded — what it asked for, what came back, whether it was allowed, and how long it took. Refused calls are recorded too. You can read the record in three places.

The Activity tab

Open MCP from the user menu and choose Activity. The left side lists your clients; the right side lists every call the selected client made in the last 30 days, newest first. It updates live while a client is working. Click a call to see the full request and response.

Only you can read this — not other users, and not an administrator.

A lab's own Activity tab

Deploys and stops made by an assistant also appear on the lab's Activity tab, marked via MCP, so you can tell them from your own clicks.

Ask the assistant

On a Pro account the assistant can read the same record for you. Reading it is not itself recorded, so asking does not bury the answer.

You ask	Tool it uses
"What happened to my Essentials lab today?"	my_history, narrowed to that lab
"Who stopped my lab?"	my_history — each row names the client that did it
"What's been refused recently, and why?"	my_history, refused calls only
"What has Cursor been doing on my account?"	my_mcp_clients, then my_history for that client
"Which clients are connected to my account?"	my_mcp_clients

Credentials are removed from the recorded requests and responses.

Tools that cannot be undone

Most of what an assistant does can be reversed — a stopped lab redeploys, a removed domain can be added again. These cannot, and deserve a moment before you agree:

Tool	What is lost
terminate_lab	An extra copy of a lab, destroyed
delete_lab_path	A file or folder in a lab. There is no undo and no trash
write_lab_file over an existing file	The previous contents of that file
delete_database	A database and everything in it
remove_service_user	A database user and every database under it
delete_template	A lab template (asks for a typed confirmation)
delete_network	A private network, for everyone using it
delete_device / delete_ssh_key	A device's VPN access, or a key's logins
delete_domain	A domain name — someone else may register it
org_remove_member(s), org_transfer_execute	Someone's access, or ownership moved to someone else

Also worth a second look:

• Redeploying a lab you are working in. Only your home directory survives; anything installed or changed elsewhere is rebuilt away.
• Replacing a lab's domain list. Domains not in the new list are detached. The assistant reads the current list first to avoid this — if it did not, ask it to.
• renew_lab — the only tool that spends currency (Jolt). Redeploying resets the expiry for free and is almost always the better choice.

Tell it to ask first

Assistants are designed to confirm before deleting, spending or deploying. You can make that a rule: "Always ask me before you delete anything, redeploy a lab or spend Jolt." Putting that line in a lab's Agent Prompt makes it stick for that lab.

Steer it: the Agent Prompt and PROMPT.md

Assistants make fewer mistakes when they know the lab's conventions.

• Per lab: open the lab → Preferences → Agent Prompt, write your instructions (up to 64 KB), and click Save Agent Prompt. Good things to include: where the code lives, how to start and test the app, which folders are off-limits, and when to ask before acting.
• From the template: if a lab's Agent Prompt is empty, the assistant gets the template's PROMPT.md instead. Template authors write it — see Auto-login and connection info.

Keep secrets out of prompts

Anything in a prompt or an Agent Prompt is sent to the AI provider behind your client. Do not put passwords or keys there.

Disconnect a client

1. Open Account Settings → Security.
2. Under MCP clients, find the client. Live means it used your account in the last few minutes; Idle clients still hold a working sign-in.
3. Click Disconnect.

The client cannot do anything more until it signs in and is approved again. Disconnect clients you no longer use — an idle client keeps its sign-in until you do.

A short checklist

• Approve only clients you started.
• Look at the Activity tab after letting an assistant work unattended.
• Ask it to confirm before anything in the table above.
• Keep secrets out of prompts.
• Disconnect clients you no longer use.

Next

• How MCP connections are secured
• Connect an AI assistant — set up, check and disconnect a client
• Workspace and files — what the assistant does inside a lab
• Stop, pause and delete — what each lab action really does