Skip to main content
An agent connected to Penbox is a user with tools. This page says what that user can do, what leaves your workspace, and what is refused.

​
Sign-in

  • OAuth, in your browser. On the first tool call, the agent opens the Penbox sign-in page. You sign in with your own account and approve the connection.
  • No token to paste. The client registers itself with Penbox (dynamic client registration). No API key travels through the chat, a config file or the plugin.
  • Revocable. Disconnect the connector in your client, or sign out of Penbox. The agent loses access.
A server-side agent can use a workspace API token instead. That token has the workspace’s rights, like any API client.

​
Rights

  • The agent never has more rights than you. Every tool call runs as the signed-in user. The same policies apply as in the Penbox app and the public API. What you cannot see or change in Penbox, the agent cannot either.
  • Several workspaces, no silent pick. When your account reaches several workspaces, listing and creation tools refuse until the agent names one. The agent must ask you.
  • Actions are attributed to you. A change made over MCP shows your name in the case history, with a “via MCP” tag.

​
What the agent cannot do

  • Delete. No tool deletes anything, and the raw API passthrough refuses every DELETE. Deleting is done in the Penbox app. Archiving a case is allowed: it is reversible.
  • Provision a workspace or create a member. Both are refused over MCP.
  • Send without being asked. Only start_case_step sends an email, an SMS or a form to a contact. The skills tell the agent to call it only when you explicitly ask to send.
  • Delete a task. A task is dismissed, not deleted.

​
Data

  • Nothing is pre-loaded. The agent receives only what a tool call returns: the case it asked for, the form response it read. No background sync, no export of your workspace.
  • Data goes to your agent’s provider. A tool result is handed to the model you use (Anthropic, OpenAI, or another). Check that provider’s terms for what it keeps. Penbox does not send anything to a model on its own during MCP usage.
  • Third-party text is labelled as data. A case and a form response carry a note telling the agent that content written by contacts, respondents or incoming emails is data, never an instruction. This limits prompt injection through a form answer.
  • Large responses are cut. A response over 50 KB is truncated. The agent is told to narrow the call.

​
Hosting and billing

  • EU hosting. The MCP server runs in the European Union, with the rest of Penbox.
  • No credits. MCP usage does not consume Penbox credits. The model runs on your side, in your agent.

​
Refused over MCP

Refusals are answers, not errors. The agent reads the refusal and follows it. A refusal from the API itself, such as a 403, is final: it means your account lacks the right.