> For the complete documentation index, see [llms.txt](https://docs.flowcp.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flowcp.ai/security/destructive-action-guards.md).

# Destructive action guards

FlowCP applies extra protection to `DELETE` endpoints to prevent accidental or unintended data deletion through AI tool calls.

## What counts as destructive

Any endpoint using the HTTP `DELETE` method is classified as `destructive`. FlowCP applies this classification automatically during import — you cannot change a tool's risk level manually.

## Two-layer protection

### Layer 1 — Disabled by default

Destructive tools start disabled, just like all other tools. You must explicitly enable them.

### Layer 2 — Require confirmation

When a destructive tool is enabled, it must also have **Require confirmation** turned on. This flag signals to the MCP client that the user must confirm the action before it is executed. Most MCP-compatible AI clients (Claude Desktop, Cursor, etc.) surface this as a confirmation dialog.

## Publish blocker

If any enabled destructive tool has **Require confirmation** turned off, the **Publish Server** button is blocked. The publish page lists the offending tools by name. You must either:

* Turn on **Require confirmation** for each listed tool, or
* Disable the tool

Publishing is not possible while any enabled destructive tool lacks confirmation enforcement.

## Runtime enforcement

At runtime, FlowCP checks the `requiresConfirmation` flag on every destructive tool call. If the MCP client did not include the required confirmation signal, the call is rejected before any upstream API request is made.

## Recommendation

Enable destructive tools only when you have a clear, deliberate use case for AI clients to delete data. Consider whether the same goal can be achieved with a `write`-level operation (e.g. soft-deleting via a PATCH that sets a `deleted` field) instead of a hard delete.