Security and scopes
What an agent connected over MCP can see, what it must be granted before it spends or sends, and how to take that grant away.
Everything here applies to the connector at https://mcp.argorant.com/mcp.
Boundaries
- A connector is bound to one signed-in Argorant account. Nothing is anonymous; every call is attributable.
- Counts, coverage and masked previews are free. Preview rows never carry emails, phones or profile URLs.
- Reveals, enrichment and exports run against the connected workspace's plan and credit balance.
- Campaign tools act on the connected workspace only. Launching and replying send real email, and buying credits or mailboxes charges money; those tools are marked so clients ask you first.
- Workspaces are kept apart. An agent cannot list or touch another workspace's campaigns, leads or replies.
Scopes
| Scope | Cost | Unlocks |
|---|---|---|
argorant:read_counts | Free | Counts, account, reading campaigns, the inbox, mailboxes and webhooks |
argorant:search_segments | Free | Coverage search and masked previews |
argorant:manage_lists | Free, except mailbox orders and credit purchases after a yes | Saved lists, campaign changes, launch, replies, statuses, blocklist, webhooks, mailbox orders, credit purchases |
argorant:verify_emails | Half a credit per fresh check | Check lists you already have; addresses checked recently are free |
argorant:create_exports | Credits | Export jobs and list exports |
argorant:unlock_contacts | Credits | Reveals, phone numbers, person enrichment, the email finder |
Tool annotations
Every tool declares readOnlyHint, openWorldHint and destructiveHint. Read tools update private usage records and are therefore not marked read-only; argorant_launch_campaign, argorant_inbox_reply, argorant_delete_campaign, argorant_set_campaign_emails and argorant_update_campaign are destructive; anything that checks emails or sends email is open-world.
Revoking access
Disconnect the connector in the client, or revoke the grant at app.argorant.com/profile → Connected apps. Rotating or deleting an API key does not affect MCP grants, and vice versa.