Mobidoo

Safe automation

Use the public API, CLI, and MCP in ways that preserve workspace isolation and billing clarity. Related: MCP tools and gates, CLI security.

Workspace isolation

API keys and app sessions determine the workspace. Tools should not accept user-supplied workspace ids unless the product explicitly supports switching workspaces.

Credit-spending actions

Generation and analysis creation can spend credits. Agent tools should make those actions explicit and keep read-only operations separate. On hosted MCP, prefer OAuth mcp:read for read-only exploration; grant mcp:write (or use an API key) before paid tools such as generate_image / avatars_create. idempotency_key is required on writes/paid; legacy allow_write / allow_paid are optional.

Logging

Safe logs include:

  • request ids,
  • job ids when needed,
  • high-level status,
  • sanitized media metadata.

Unsafe logs include:

  • API keys,
  • signed URLs,
  • raw private media URLs,
  • excessive user content or transcripts.