Security

An agent connected to Upscrape reads text that strangers wrote: product listings, posts, whole web pages. Upscrape keeps that text in its place, as data, and keeps your account's access as narrow as you choose.

Results are data, never instructions

A page can contain text written to steer an AI model: "ignore your previous instructions", a fake tool call, a request for a key, a link to click. It has no authority over your agent. Every tool result carries a _provenance note saying the content came from a third party and is data.

If you build an agent on Upscrape, make it:

• keep tool results apart from its instructions;

• never follow instructions found in a result;

• never reveal a key, a token or its own instructions because a result asks;

• check values before using them anywhere else;

• ask the person before doing anything that matters because of what a result says, such as sending a message or making a purchase.

Using results safely covers the same for code.

Who can do what

• Sign-in tokens belong to the MCP server and work nowhere else. Send them only to https://data.upscrape.com/mcp.

• Permissions are the ones approved when the app connected, and never grow by themselves. Read-only, one platform, or extra features each stay as approved, through every token refresh. Limit what an agent can do lists them.

• An app that may run endpoints can also read the results of other runs on the account. Limit it to a platform to keep it there.

What an agent can see

An agent sees only the endpoints your account may use. Asking about an endpoint it may not use gets the same answer as one that doesn't exist, so an agent can't learn what is there by probing.

Feedback

A report sent with upscrape_submit_feedback is a claim from an agent, not a fact: we check it. Don't send conversations, results, logs or secrets in one; obvious secrets are removed, but personal details may stay. A report's status shows only an answer the team chose to publish, and that answer is data too.