Get Started

MCP Security: What Data AI Tools Can Access and How to Stay Safe

Published

AI can build your emails — but what else can it do?

Connecting an AI assistant to your email builder is powerful: you describe what you want, and the AI creates, edits, and arranges the content for you. But that connection means the AI can access your workspace — your templates, your branding, your draft emails. Before you hand over the keys, it’s worth understanding exactly what the AI can see, what it can change, and how to keep that access under control.

The Model Context Protocol (MCP) is what makes this connection possible. It’s the standard that lets AI assistants like Claude interact with external tools — including email builders like Temway. Understanding the security model behind that interaction helps you use AI confidently without exposing your content.

What MCP access actually means

When you connect an AI assistant to a tool via MCP, you’re giving it a set of capabilities — things it can read and things it can change. The exact capabilities depend on what the tool exposes, but in the context of an email builder, they typically include:

  • Reading your existing content — the AI can see your draft emails, saved templates, and reusable layouts. This is necessary so it can build on your existing work.
  • Creating new content — the AI can create new emails, add blocks, write text, and place images.
  • Editing existing content — the AI can modify drafts you’ve already started, change text, rearrange blocks, and update settings.
  • Accessing your branding — the AI can read your workspace branding (colors, fonts, logo) so that what it builds is on-brand.

What the AI cannot typically do through an MCP connection to an email builder:

  • Send emails. Temway is a builder and exporter, not an ESP. The AI can build and edit emails, but sending happens in your ESP — a separate system the AI doesn’t touch.
  • Access your subscriber list. Your ESP holds your subscriber data, not the email builder. The AI can’t see who’s on your list.
  • Access billing or account settings. MCP connections are scoped to content creation, not account administration.
  • Access data from other tools. Each MCP connection is separate. Connecting an AI to your email builder doesn’t give it access to your CRM, your analytics, or any other tool unless you set up those connections separately.

Why security awareness matters

  • AI is powerful, and power needs boundaries. An AI that can create content can also change content you didn’t want changed. Understanding the scope of access helps you set appropriate boundaries.
  • Your content is your intellectual property. Draft emails, campaign strategies, and brand assets are valuable. Knowing who (and what) can access them is a basic security practice.
  • Mistakes can be hard to undo. If an AI modifies a draft in a way you didn’t intend, you need to catch it before the email ships. Awareness of what the AI can change helps you review effectively.
  • Trust but verify. AI is a collaborator, not an autonomous agent. The best results come when you understand the AI’s capabilities and review its work — not when you blindly accept whatever it produces.

How to use MCP connections safely

  1. Understand what you’re connecting. Before linking an AI assistant to any tool, read what capabilities the connection grants. A good MCP implementation clearly documents what the AI can read and what it can change. See What Is MCP? and MCP for Email.
  2. Use a dedicated connection key. When you set up an MCP connection, you’ll typically generate a connection key (sometimes called an API key or access token). Use a dedicated key for each AI assistant, so you can revoke access for one without affecting others. Never share keys between tools.
  3. Review what the AI creates. AI-generated content should be treated like a first draft from a teammate — useful, but not final. Review the email, check the copy, verify the links, and send a test copy before publishing. See AI Email Writing Best Practices.
  4. Revoke access when you’re done. If you used an AI assistant for a specific project and no longer need the connection, revoke the key. Active connections that you’ve forgotten about are a common security gap.
  5. Keep your connection key private. Treat your connection key like a password. Don’t commit it to code repositories, don’t share it in chat, and don’t paste it into untrusted tools. If a key is compromised, revoke it immediately and generate a new one.
  6. Be transparent with your team. If multiple people use your workspace, make sure everyone knows an AI assistant has access. This prevents confusion when drafts change unexpectedly.
  7. Choose tools that scope their access. Not all MCP implementations are equal. Temway’s MCP server is scoped to content creation — it can build and edit emails, but it can’t send them, access your subscriber list, or change account settings. Prefer tools that follow this principle of least access.

Common mistakes

  • Connecting without reading the scope. You hand over access without understanding what the AI can do. Later, you’re surprised by what it changed.
  • Sharing one key across tools. When one tool’s key is compromised, every tool using that key is exposed. Use separate keys.
  • Never revoking old connections. You connect an AI for a one-time project, finish the project, and forget the connection is still active months later.
  • Blindly accepting AI output. The AI creates an email, you publish it without reviewing, and a mistake goes out to your entire list. Always review.
  • Committing keys to code. You store your connection key in a config file that gets pushed to a shared repository. Anyone with repo access now has access to your workspace.
  • Assuming AI can’t make mistakes. AI is a tool, not an expert. It can write copy that’s off-brand, place blocks in the wrong order, or create content that doesn’t match your intent. Review is not optional.

How to handle MCP security with Temway

Temway’s MCP server is designed around the principle of least access. When you connect an AI assistant to Temway, the connection is scoped to content creation: the AI can create and edit emails and layouts, read your branding, and preview its work. It cannot send emails (that happens in your ESP), access your subscriber list, or modify account settings.

The connection is authenticated with a dedicated key that you generate and control. You can revoke it at any time. Use separate keys for each AI assistant, and revoke keys you no longer use.

When the AI creates or edits an email, review the result in the builder before publishing. Use Test send to deliver a copy to your own inbox, and check that the content, design, and links are correct. When everything looks right, publish or push to your ESP for sending.

Where to go next