Skip to main content
When an app connects to Auxilian, you approve it on a consent page. This page explains what you are approving.

​
The approval page

After you sign in, Auxilian shows a page titled Allow app name to use Auxilian? It lists:
  • The app’s name, as the app registered it
  • Your account: the email address the app will act as
  • What it can do: read only, or read and write
  • Where access goes: the host that receives the authorization, such as claude.ai
Select Allow only if you started the connection yourself and trust that app. Select Cancel to refuse. The app receives an access_denied error and gets no access.
If you see this page without having just added a connector, close the window. Someone may be trying to get you to authorize their app.

​
Read and write access

Auxilian has two access scopes: The app chooses which scopes to request, and the approval page shows the result. An app that requests no specific scope gets both. Write access always includes read access. If an app with read-only access calls a write tool, the call fails with:
To change a connection’s access, remove it from the app and connect again.

​
Your permissions still apply

Approving a connection never grants more than you already have. The app acts as you, in every workspace you belong to:
  • It sees only the projects you can open.
  • It writes only to projects where you have write access.
  • It creates projects only in workspaces where you are an owner or admin.
  • It is held to the same limits and rate limits as you.
If your access changes, the connection’s access changes with it. When someone removes you from a workspace or revokes your project access, the connected app loses that access immediately.

​
Accountability

Every write an app makes is recorded in the project’s activity log with:
  • Actor: you
  • Surface: mcp
  • Action and details: for example insert_rows with count: 3 · table: books
Refused writes are recorded too, as write.denied events, when the target project exists. See Activity events.

​
Protections on the connection flow

  • Sign-in and approval links are single use and expire after 10 minutes.
  • The approval form only accepts submissions from the same browser session that opened it, and only from Auxilian’s own pages.
  • The approval page cannot be embedded in another site.
  • Apps must use PKCE, and the redirect address must match the one the app registered.