MCP Server Security for Sellers: A Checklist

MCP server security for sellers comes down to four questions: who approved the connection, what the AI can change, how fast you can cut it off, and what stays out of reach. On Pocketsflow, you approve each AI app on a consent screen, every app gets its own key you can delete in one click, payouts are read only, and payment refunds, withdrawals and bank details never go through the AI.

What the Pocketsflow consent screen shows

Pocketsflow's MCP server at https://www.pocketsflow.com/mcp uses OAuth 2.1. When you add it to Claude, ChatGPT, Cursor or another app, your browser opens a Pocketsflow page titled "Connect <app> to Pocketsflow". Read it before you click. It shows:

• The app's name, and "Signed in as" with the email of the account it will use.
• A "Test mode" badge when your account is in test mode.
• "It will be able to": create and edit products; read your sales, orders, and customers; set refund policies, send newsletters, and manage discounts.
• The name of the key it will create: "MCP: <app>".
• "You'll return to" and the host the browser goes back to.

If the app name, the email or the return host looks wrong, click Cancel. Pocketsflow creates nothing. The sign-in request also expires after 30 minutes, so an old link someone sends you will not work.

How Pocketsflow keys and tokens work

When you click Allow access, Pocketsflow creates a dedicated API key named "MCP: <app>" under Developers, API keys. The key itself never leaves Pocketsflow. The AI app only gets OAuth tokens with the mcp:tools scope.

• Access tokens last one hour and only work at the Pocketsflow MCP address.
• Refresh tokens are single use and rotate on every refresh. One left unused for 30 days expires, and the app has to ask you again.
• Deleting the "MCP: <app>" key stops that app on its next request. Other apps keep working, because each has its own key.

Developers can skip OAuth and send a pk_test_ or pk_live_ API key in an Authorization: Bearer header. Treat that key like a password: never paste it into a chat, and never commit it to git.

What a Pocketsflow AI can look up and what it can change

Pocketsflow exposes 303 MCP tools. By name, 158 are look-ups (they start with get_, list_ or search_) and 145 can create, update, send or delete something. The chart splits the areas sellers ask about most.

Payouts have 4 look-up tools and 0 that change anything. Orders have 6 look-ups and 0 changes. Team has 8 tools that change something, such as invite_team_member and remove_team_member, so it deserves the same care as products and emails.

What Pocketsflow keeps out of the AI

Pocketsflow draws hard lines around money. These stay in the dashboard, whatever the AI is told:

• Payment refunds. The create_refund, list_refunds and get_refund tools manage refund policies, never a refund of a payment.
• Withdrawals. get_payout_status, get_payout_balance, list_payouts and get_payout only read.
• Adding or changing a bank account, and identity checks.
• Buying or changing a Pocketsflow plan.

Prompt injection and the Pocketsflow MCP server

Prompt injection is text that tries to give your AI orders. In a store, that text can arrive inside data: a review, a testimonial or a community thread written by a buyer. Pocketsflow's server only offers tools, with no server prompts or resources, but a tool result can still carry text a buyer wrote. Pocketsflow does not claim to filter that text, so the guard is how you run the AI.

• If your AI app asks before each tool call, keep that setting on.
• Read the tool name before you approve. A request to read reviews should not end in send_email or delete_product.
• Ask the AI to show a draft first: "Draft the discount, then wait for my yes before create_discount."

The Pocketsflow MCP security checklist

1. Switch the Pocketsflow dashboard to test mode, then connect. The consent screen shows the Test mode badge, and the key only touches test data.
2. On the consent screen, check the app name, the email and the return host. Cancel if one is wrong.
3. Try your prompts on test data. Connect again in live mode once they behave.
4. Use one connection per app, so each has its own "MCP: <app>" key.
5. Keep tool approval on for anything that sends, deletes or invites.
6. Once a month, open Developers, API keys and delete every "MCP:" key you no longer use.
7. Never paste an API key into a chat or a prompt. Keys go in the app's MCP settings only.
8. Do refunds, withdrawals and bank changes in the dashboard.

Pocketsflow team roles and AI access

Pocketsflow team members are on the Growth plan and up. An owner can do everything, an admin can do everything except payouts, billing and ownership, and a member only opens the areas of their teams. API keys and webhooks are their own area, so you choose who can create or delete keys. Give each person their own login instead of a shared one, and the activity log shows who changed what.

Where to go next with Pocketsflow MCP

Start at the Pocketsflow MCP page to connect, and read the Pocketsflow security page for how the platform protects accounts. To see every tool group, read what Pocketsflow MCP can do, and to choose between MCP and the API, read MCP vs API for selling online.