MCP safety and plans

CreatorsJet MCP tools resolve an authenticated actor containing the OAuth principal, creator or agency subject, user, granted scopes, and request ID. Tools apply subject ownership and scope checks before calling shared application services.

Write-safety rules

Agents using the preview should follow these rules:

Validate a roster import before commit, show the complete preview and capacity impact, and obtain approval before roster_commit_import.
Obtain explicit confirmation immediately before social_remove.
Use link_in_bio_get before choosing create or update.
Use deck_list or deck_get before deck_update.
Use campaign_list or campaign_get before campaign_update.
Never start checkout, subscribe the user, or modify billing on the user's behalf.

Tool annotations identify read-only, idempotent, and destructive behavior for clients that support MCP annotations. Clients should still present an understandable confirmation when a destructive or consequential action is about to run.

Tenant isolation

Creator tools act on the creator resolved from OAuth. Agency tools act on the agency and, where required, creators already in its roster.

Cross-tenant IDs do not grant access. Owned-resource services include the subject predicate in database queries, and inaccessible resources are reported as not found.

Plans and allowances

OAuth grants role-compatible scopes; it does not grant a paid entitlement. Plan-sensitive tools reuse the applicable CreatorsJet product rules when invoked, including creator and social capacity, media-kit rules, deck capacity, active-campaign capacity, analytics eligibility, and Sponsorship Intelligence access.

A plan or allowance failure returns a safe structured action. Example:

{
  "ok": false,
  "error": {
    "code": "LIMIT_EXCEEDED",
    "message": "Your agency has reached its active campaign limit.",
    "retryable": false,
    "details": {
      "usage": {
        "current": 30,
        "limit": 30,
        "requested": 1,
        "remaining": 0
      },
      "upgrade_url": "https://www.creatorsjet.com/a/my-plan?tab=upgrade&source=mcp",
      "action_label": "View agency plans"
    }
  }
}

Usage appears only when the service can safely provide it. The text fallback also includes the upgrade URL for clients that do not display structured content.

Context	Authenticated CreatorsJet destination
Creator plan or allowance	`https://www.creatorsjet.com/my-plan?tab=subscription&source=mcp`
Agency plan or allowance	`https://www.creatorsjet.com/a/my-plan?tab=upgrade&source=mcp`
Sponsorship Intelligence	`https://www.creatorsjet.com/dashboard/sponsor/my-plan?source=mcp`

The tool proposes the relevant page only. It never initiates checkout.

Error handling

Tool results use an ok envelope. Errors contain a sanitized code, message, retryability flag, optional details, and optional retry_after_seconds.

Common codes include:

Code	Meaning
`AUTHENTICATION_REQUIRED`	OAuth authentication is absent or expired
`SCOPE_REQUIRED`	The grant lacks the tool's required scope
`ROLE_FORBIDDEN`	The account role cannot use the tool
`PLAN_REQUIRED`	The operation requires an eligible plan
`LIMIT_EXCEEDED`	A current product allowance is exhausted
`VALIDATION_FAILED`	Tool input or normalized request data is invalid
`NOT_FOUND`	The resource is absent or inaccessible to the subject
`CONFLICT`	The request conflicts with current state or another operation
`RATE_LIMITED`	The tool's safety limit was reached
`RETRYABLE_INTERNAL`	A temporary internal failure prevented completion

MCP tool safety limits are separate from product-plan allowances. When retry_after_seconds is present, clients should wait at least that long and avoid parallel retries.

Audit and data handling

Preview audit events record tool name, outcome, client and user identifiers, request ID, duration, result code, and queue ID when applicable. Tool arguments, spreadsheet rows, OAuth tokens, emails, social handles, and creator payloads must not be written to audit events or application logs.