Security and access

An agent connected to FounderSync is not a separate account with its own powers. It acts as you, under your permissions, after you approve it. This page explains what that means and where the limits are.

Consent#

The first time you connect an agent, you are sent to the consent screen at https://foundersync.io/oauth/consent. It shows the agent's name and the account you are signed in as, and it lists what the agent can and cannot do. You choose Allow access or Deny.

The screen says an approved agent can read your startup's idea, PRD, tasks, vault, cofounder agreement and cap table; create and change records such as tasks, the idea, the PRD, the launch checklist, vault documents and cap table entries; and model rounds and exits, closing a round only when you tell it to. It says the agent cannot sign the agreement or verify your identity for you, change your password or email or delete your account, or see other people's startups. Only approve a request you started yourself.

The agent acts as you#

Sign-in is OAuth 2.1 through Supabase Auth. After you approve, the agent gets an access token for your account, and the FounderSync server uses that same token for every database call. The server holds no service key and no admin credentials. Row-level security in the database therefore decides what the agent can read and change, exactly as it does in the web app.

Other rules apply:

• The server only accepts tokens issued to an OAuth client you approved. A token from your normal browser session is rejected.
• A tool that takes a startup_id checks that you are an active member of that startup. You cannot reach other people's startups.
• Tools keep their own limits. Only the startup creator can change a member's equity, role or permissions, and log_contribution always logs work for you.
• What an agent changes in a startup is visible to your cofounders.

Read-only endpoint#

Connect to https://mcp.foundersync.io/mcp/readonly and write and destructive tools are not registered at all, so the agent cannot call them. Only the 53 read tools are offered. See the tools reference.

Destructive tools need confirmation#

Tools that delete data, or record something that cannot be undone such as closing a financing round, require confirm: true. A call without it fails.

What agents do not get#

The server has no tool to:

• Sign the cofounder agreement or verify identity. Each founder does that in the app.
• Change or reset passwords.
• Delete your account or a startup.
• Read or return stored integration tokens. list_integration_connections shows which integrations are connected, never the credentials.

Audit log#

When an agent makes a change to startup data, the server writes a record to the agent_actions table. The action type is mcp:<tool>, for example mcp:create_tasks, and the description names the tool and the client that made the call. The record also keeps the arguments, with long text trimmed to 300 characters and long lists shortened.

The log covers write and destructive tools that work on a startup. Changes to your own settings, profile and notifications, and creating a startup, are not recorded there. Writing the record is best effort and never blocks the action.

In the app, Settings, AI Agents lists your 25 most recent agent changes under "What agents changed".

Revoke access#

Settings, AI Agents also has a "Connected agents" list with a Disconnect button for each agent. It relies on Supabase's OAuth grants API. If that list cannot be loaded, the page shows "Connected agents will show here once you connect one" instead, and there is nothing to disconnect from there.

You can also remove the connector in the client itself. In Claude Code, run claude mcp logout foundersync and then claude mcp remove foundersync; in Cursor and Codex, remove the server from your config.