MCP security and costs
How the Slicer MCP server protects your balance and data — price confirmation, spend limits, scopes, destructive actions and commands hidden in text.
On this page
An AI assistant acts on your behalf, so the server is designed so that neither a model's mistake nor someone else's text in your materials leads to unwanted spending or lost data. The protection has several layers.
What's free
Editing by your assistant is entirely free — like Edit it myself in the app: creating a project
(create_project by default), reading the video, editing it with operations, changing the style and colour, exporting
and publishing, choosing a version, renaming and deleting projects, uploading files and searching the docs. Only Slicer's
own AI features spend tokens.
Price confirmation
No paid tool spends tokens without confirmation:
- The assistant calls a tool without
confirmCost— the server returns the price, the balance and what's left of the limit, and starts nothing. - The tool description requires the model to show you the price and wait for your consent.
- A repeated call with
confirmCostequal to the price just quoted starts the operation. If the price changed in the meantime, the server refuses (cost_changed) and the assistant has to name the new price.
Paid tools are Slicer's AI features:
| Feature | Tools | Price |
|---|---|---|
| AI montage by the Slicer director | create_project with mode: "ai", remount_project, retry_project | 24 tokens per video up to 90 seconds, the first video is free |
| Captions from speech | transcribe_speech | at cost per minute of sound |
| The Slicer AI assistant | ask_assistant | at cost |
| Caption translation | translate_captions | at cost |
The tool descriptions ask the model only to offer them, and to start the AI director only when you ask for it.
create_project without mode creates a free project without the AI director — with no price and no confirmation.
Priced at cost
transcribe_speech, ask_assistant and translate_captions cost exactly what their AI calls cost, with no markup;
captions from speech — per minute of sound of the chosen sources. The exact price is only known after the operation, so a
call without confirmCost returns two numbers:
estimate— the expected price (fractional); the assistant shows it to you as a guide;cost— the maximum price: the assistant passes it inconfirmCost, and you're never charged more than that.
After the operation, the actual cost is charged — never more than the maximum, and only if the operation worked: the
assistant changed something, the translation or recognition succeeded (if recognition fails, the tokens come back). Whole tokens are taken from the balance; the fractional remainder accumulates with the project. The enough
field in the response shows whether the balance and the connection's spend limit cover the expected price.
Spend limit
Every connection has a monthly token limit. On the OAuth consent screen it's 200 tokens a month by default; for an API
token — whatever you set when creating it. An operation that doesn't fit into the limit doesn't start
(spend_limit_exceeded), even if your balance is sufficient. Spending this month is shown in Profile →
Developers, where you can also change the limit.
Scopes
Scopes limit which tools the assistant can use at all:
| For the assistant to… | Keep | Remove |
|---|---|---|
| only view projects and answer questions | Read only | everything else |
| create projects and edit them itself, with paid features only after your consent | the Montage preset | publish, if it doesn't need to publish |
| create projects, edit and export them itself and never spend a single token | projects:write | montage:run |
A free “Edit it myself” project (create_project) needs no montage:run — projects:write is enough. The montage:run
scope is only for paid AI features: nothing is charged under it without a confirmed price, and the connection's spend
limit caps spending on top.
More on scopes — Tokens and scopes.
Destructive actions
delete_project deletes a project with its files, cancel_project stops a running montage, remount_project rebuilds
the video with the AI director from scratch. They are marked as destructive (destructiveHint) — clients that honor annotations ask before
calling them. Reading is marked readOnlyHint; importing from a URL, export with publishing and the docs search are
marked openWorldHint: they reach external services.
Text is data, not commands
Tool results contain text written by people: project titles, captions, wishes for the director, publication descriptions. Someone could hide a command for the model in such text. That's why:
- tool descriptions tell the model explicitly that user text is data, not instructions;
- service fields of a response are kept separate from user text;
- dangerous actions still need confirmation: the price —
confirmCost, deletion — the client's prompt.
If the assistant suddenly suggests an action you didn't ask for, decline and check where the idea came from.
Server protection
- HTTPS and header tokens only. The server doesn't accept cookies, so a website open in your browser can't act on your behalf.
Origincheck. Browser requests to the MCP server are accepted only from trusted origins; others get403— this protects against DNS rebinding attacks.- Short-lived connection tokens. An OAuth access token lives one hour; reusing a replaced refresh token revokes the whole connection.
- Logging. Every call updates the connection's "last used" time, and paid operations are recorded in the project history — you can see what the assistant did and when.
How the account, files and payments are protected in general — on the Security page.
If something goes wrong
- Disconnect the app: Profile → Developers → Connected apps → Disconnect (or Revoke for a token). Access stops immediately.
- Stop a running montage — in the app, or ask the assistant to call
cancel_project: the reserved tokens come back. - If a montage fails, tokens aren't charged: the reservation returns to your balance automatically.