Destructive action guards

FlowCP applies extra protection to DELETE endpoints to prevent accidental or unintended data deletion through AI tool calls.

What counts as destructive

Any endpoint using the HTTP DELETE method is classified as destructive. FlowCP applies this classification automatically during import — you cannot change a tool's risk level manually.

Two-layer protection

Layer 1 — Disabled by default

Destructive tools start disabled, just like all other tools. You must explicitly enable them.

Layer 2 — Require confirmation

When a destructive tool is enabled, it must also have Require confirmation turned on. This flag signals to the MCP client that the user must confirm the action before it is executed. Most MCP-compatible AI clients (Claude Desktop, Cursor, etc.) surface this as a confirmation dialog.

Publish blocker

If any enabled destructive tool has Require confirmation turned off, the Publish Server button is blocked. The publish page lists the offending tools by name. You must either:

• Turn on Require confirmation for each listed tool, or

• Disable the tool

Publishing is not possible while any enabled destructive tool lacks confirmation enforcement.

Runtime enforcement

At runtime, FlowCP checks the requiresConfirmation flag on every destructive tool call. If the MCP client did not include the required confirmation signal, the call is rejected before any upstream API request is made.

Recommendation

Enable destructive tools only when you have a clear, deliberate use case for AI clients to delete data. Consider whether the same goal can be achieved with a write-level operation (e.g. soft-deleting via a PATCH that sets a deleted field) instead of a hard delete.