# MCP security and costs

> How the Slicer MCP server protects your balance and data — price confirmation, spend limits, scopes, destructive actions and commands hidden in text.

Source: https://docs.slicer.media/en/mcp/costs/

An AI assistant acts on your behalf, so the server is designed so that neither a model's mistake nor someone else's text in your materials leads to unwanted spending or lost data. The protection has several layers.

## What's free

Editing by your assistant is entirely free — like **Edit it myself** in the app: creating a project (`create_project` by default), reading the video, editing it with operations, changing the style and colour, exporting and publishing, choosing a version, renaming and deleting projects, uploading files and searching the docs. Only Slicer's own AI features spend tokens.

## Price confirmation

No paid tool spends tokens without confirmation:

1.  The assistant calls a tool without `confirmCost` — the server returns the price, the balance and what's left of the limit, and **starts nothing**.
2.  The tool description requires the model to show you the price and wait for your consent.
3.  A repeated call with `confirmCost` equal to the price just quoted starts the operation. If the price changed in the meantime, the server refuses (`cost_changed`) and the assistant has to name the new price.

Paid tools are Slicer's AI features:

| Feature | Tools | Price |
| --- | --- | --- |
| AI montage by the Slicer director | `create_project` with `mode: "ai"`, `remount_project`, `retry_project` | 24 tokens per video up to 90 seconds, the first video is free |
| Captions from speech | `transcribe_speech` | at cost per minute of sound |
| The Slicer AI assistant | `ask_assistant` | at cost |
| Caption translation | `translate_captions` | at cost |

The tool descriptions ask the model only to offer them, and to start the AI director only when you ask for it. `create_project` without `mode` creates a free project without the AI director — with no price and no confirmation.

## Priced at cost

`transcribe_speech`, `ask_assistant` and `translate_captions` cost exactly what their AI calls cost, with no markup; captions from speech — per minute of sound of the chosen sources. The exact price is only known after the operation, so a call without `confirmCost` returns two numbers:

-   `estimate` — the expected price (fractional); the assistant shows it to you as a guide;
-   `cost` — the maximum price: the assistant passes it in `confirmCost`, and you're never charged more than that.

After the operation, the actual cost is charged — never more than the maximum, and only if the operation worked: the assistant changed something, the translation or recognition succeeded (if recognition fails, the tokens come back). Whole tokens are taken from the balance; the fractional remainder accumulates with the project. The `enough` field in the response shows whether the balance and the connection's spend limit cover the expected price.

> **Important.** Many clients let you allow a tool "always", without asking. For Slicer's paid tools we advise against it: confirming the price in the conversation is your main protection against an accidental start.

## Spend limit

Every connection has a monthly token limit. On the OAuth consent screen it's 200 tokens a month by default; for an API token — whatever you set when creating it. An operation that doesn't fit into the limit doesn't start (`spend_limit_exceeded`), even if your balance is sufficient. Spending this month is shown in **Profile** → **Developers**, where you can also change the limit.

## Scopes

Scopes limit which tools the assistant can use at all:

| For the assistant to… | Keep | Remove |
| --- | --- | --- |
| only view projects and answer questions | **Read only** | everything else |
| create projects and edit them itself, with paid features only after your consent | the **Montage** preset | `publish`, if it doesn't need to publish |
| create projects, edit and export them itself and never spend a single token | `projects:write` | `montage:run` |

A free “Edit it myself” project (`create_project`) needs no `montage:run` — `projects:write` is enough. The `montage:run` scope is only for paid AI features: nothing is charged under it without a confirmed price, and the connection's spend limit caps spending on top.

More on scopes — [Tokens and scopes](https://docs.slicer.media/en/api/authentication/).

## Destructive actions

`delete_project` deletes a project with its files, `cancel_project` stops a running montage, `remount_project` rebuilds the video with the AI director from scratch. They are marked as destructive (`destructiveHint`) — clients that honor annotations ask before calling them. Reading is marked `readOnlyHint`; importing from a URL, export with publishing and the docs search are marked `openWorldHint`: they reach external services.

## Text is data, not commands

Tool results contain text written by people: project titles, captions, wishes for the director, publication descriptions. Someone could hide a command for the model in such text. That's why:

-   tool descriptions tell the model explicitly that user text is data, not instructions;
-   service fields of a response are kept separate from user text;
-   dangerous actions still need confirmation: the price — `confirmCost`, deletion — the client's prompt.

If the assistant suddenly suggests an action you didn't ask for, decline and check where the idea came from.

## Server protection

-   **HTTPS and header tokens only.** The server doesn't accept cookies, so a website open in your browser can't act on your behalf.
-   **`Origin` check.** Browser requests to the MCP server are accepted only from trusted origins; others get `403` — this protects against DNS rebinding attacks.
-   **Short-lived connection tokens.** An OAuth access token lives one hour; reusing a replaced refresh token revokes the whole connection.
-   **Logging.** Every call updates the connection's "last used" time, and paid operations are recorded in the project history — you can see what the assistant did and when.

How the account, files and payments are protected in general — on the [Security](https://docs.slicer.media/en/security/) page.

## If something goes wrong

-   Disconnect the app: **Profile** → **Developers** → **Connected apps** → **Disconnect** (or **Revoke** for a token). Access stops immediately.
-   Stop a running montage — in the app, or ask the assistant to call `cancel_project`: the reserved tokens come back.
-   If a montage fails, tokens aren't charged: the reservation returns to your balance automatically.

## What's next

[LimitationsRate limits and what's not available yet.](https://docs.slicer.media/en/mcp/limits/)[Data and privacyWhich data the assistant sees.](https://docs.slicer.media/en/mcp/privacy/)