Security

The Control Tower MCP server is read-only by construction. It reports on what already exists and creates nothing.

Specifically, no tool on this server can:

• Create, edit or delete assets in Control Tower or in your BI platform. Reports, dashboards, datasets and workspaces are never touched.

• Create or change monitors. It can list monitors that already exist and when they were created. It cannot add one, edit its thresholds, or disable it.

• Create, raise, suppress, assign or resolve alerts. It reads your alert history and your current queue. Alert state changes still happen in Alerts, by a person.

• Trigger notifications or workflows. Nothing an agent asks will email an owner, post to Slack, or start a workflow.

• Add, remove or modify users, groups, teams or permissions, in Control Tower or in the connected platform.

• Add, reconfigure or remove connectors, or start a scan or a refresh.

• Write anything back to a BI platform. The server never calls the Power BI, Tableau, Qlik, Sigma, Databricks or SharePoint APIs. It reads the warehouse Control Tower has already populated.

Every tool in the Tool reference is marked read-only, and that is the whole surface. There is no privileged mode, no admin tool, and no parameter that flips a tool from reporting to writing. Action stays where accountability lives: in the app, with an owner, tracked to close.

What an agent can see

Your connectors, and only yours. Every query is scoped to the connectors the calling credential is entitled to, using the same permission model as the app. An agent cannot reach another account's estate, and cannot reach a connector your credential has no access to. Narrow further by passing an account_connector_key from list_connectors.

Metadata, not report contents. The server returns asset names, types, owners, workspaces, refresh outcomes, view counts, viewer identities, access roles, similarity scores and lineage edges. It does not return the rows inside a dataset, the visuals on a page, or the query results of a report.

Identifiable user data. Usage and access tools return names and email addresses, because that is the point of an access review. Treat a response the way you would treat an export from the app; the same handling rules apply. See Datalogz Security.