Tools and limits
search_schema, describe_table and query_data. Each query is a single SELECT, run read-only, stopped at 15 seconds, capped at 1,000 rows and 100 columns, and limited to 83 allowlisted SQL functions.
MCPPro · beta
AI assistants read your live data. They cannot write.
Anyone in a role your administrators allow connects an AI assistant to Production through the Model Context Protocol. The assistant finds the tables that person can see, reads the records their permissions allow, and has no tool that writes.
30-day trial with Pro capabilities · no card required
One named person, one permission boundary
An assistant sees only what its person can see.
Administrators allow MCP for every member or only the roles they select. A person in an allowed role signs in to Bondi and approves the assistant on a consent screen. The assistant receives three read-only tools bound to that person's permissions. Revoke the connection and its access and refresh tokens stop working.
workspace / mcp / grant Diagram
-
GrantPro · beta
- Identity
- A named person
- Environment
- Production
- Access
- That person's permissions
Administrators choose the allowed roles and can revoke any connection.
-
Tools
- search_schema
- Find readable tables
- describe_table
- Inspect one table
- query_data
- Read permitted rows, up to 1,000
No write tool and no mutation scope exist.
Diagram of one MCP grant. The tool names and the row limit are the ones Bondi's MCP server exposes.
What it does
Live answers for your team, with no way to change data.
-
Administrators set who can connect
Turn MCP on for a workspace's Production environment and allow every member or only the roles you select. Each person connects their own assistant and approves it on a Bondi consent screen. Administrators see every connection and revoke any of them, people revoke their own, and turning MCP off revokes every connection in the workspace.
-
Answers from live Production data
The assistant searches the tables its person can see, inspects the ones it needs, and runs read-only queries of up to 1,000 rows under the same permissions that person has in the apps.
-
Changes stay under your rules
An assistant connected through MCP only reads. Changes reach your records through apps, workflows and the API, where the Data API enforces 11 rule types in the write transaction and records who changed what. To change data or call other systems automatically, build a workflow.
Under the hood
The mechanisms, in detail.
The mechanisms behind the page, for the architects and security reviewers evaluating it.
Read the technical documentationAuthentication
Each person connects through the OAuth authorization code flow with PKCE and receives one scope, mcp:read. API keys and Service Accounts cannot hold an MCP grant, and revoking a grant revokes its tokens.
Per-request checks
Every request re-reads the person's roles and account status. A role change applies on the next request, a deactivated account's tokens stop working, and removing a member revokes their connections.
Designed boundaries
Where it starts and where it stops.
-
Pro only, in controlled beta: we open the beta per organization, and an administrator turns MCP on for each workspace.
-
Production only, and only for people's own accounts: API keys and Service Accounts cannot connect. MCP has no write tool and does not replace a workflow integration.
Integrations for writing data
Availability
- Standard
- Not included
- Pro
- Read-only MCP for your team's AI assistants (beta)
- Enterprise
- Read-only MCP (beta), with custom commercial terms
Questions buyers ask
Straight answers.
Can an AI assistant change data through MCP?
No. The three tools are read-only, the one scope a connection holds is mcp:read, and every query runs in a read-only transaction. Use workflows and integrations to change data.
Whose permissions does the assistant use?
Those of the person who connected it. The assistant reads only what that person can read, and a change to that person's roles applies on the next request.
Can we limit which AI apps connect?
Not app by app. Administrators choose which roles can connect, each person approves the assistant they connect on a consent screen, and administrators can revoke any connection.
How do we get access?
MCP is part of Pro and is in beta. The 30-day trial includes Pro features, but MCP stays off until we enable it for your organization. Ask us to enable it, then your administrators choose which roles can connect.
Next step
Bring the questions your team wants answered.
Tell us which AI assistant your team uses and what it should answer from Production. We'll enable the MCP beta for your organization, and your administrators choose which roles can connect.