An AI agent connected through the MCP server acts with the access token of your CLI profile: it can do what that token allows, and nothing more. To limit the agent, limit the token.

Today you connect through the CLI

The token is the one the thinger CLI keeps in the profile the MCP server uses. See Connect an AI agent.

The token of your profile

Every tool call of the agent is a call to the REST API of your server, signed with the token of the profile. The server checks it exactly as it checks any other API call:

How you signed in	Token the agent uses	What the agent can do
Username and password	A token named Thinger CLI that the CLI creates in your account.	Everything your account can do: the token has full access.
Token	The access token you gave.	Only what its permissions allow.
THINGER_TOKEN	The access token in the variable.	Only what its permissions allow.

The Thinger CLI token appears in Access Tokens like any other. thinger logout revokes it, unless you add --keep-token; you can also delete it there, and the agent loses access at once.

When the token does not allow a call, the tool fails with the error of the server, and the agent sees it:

Error [unauthorized]: Forbidden: the token or the account is not allowed to do this (not authorized).

Limit an agent with its own token

To give an agent less than full access, create an access token with only the permissions it needs, and sign in with it.

1. Create the token

   In Access Tokens, create a token with the permissions the agent needs: for example, list and read devices and Data Buckets. To limit it to the resources of one project, create the token inside the project. How permissions work is in Access Tokens.

2. Sign in with it in a separate profile

   thinger profile add agent --no-activate --server YOUR_SERVER --username YOUR_USER --token YOUR_TOKEN

   Here YOUR_TOKEN is the token you just created, and YOUR_SERVER is iot.thinger.io on the free Cloud account, or your own domain on a private instance.

3. Start the MCP server with that profile

   claude mcp add thinger-agent -e THINGER_PROFILE=agent -- thinger mcp

With a read-only token, the agent can list and read, and every attempt to create, change or delete fails with unauthorized.

Act on other accounts

Most tools take a user parameter, and every CLI command takes -u, --user: they act on another account of the same server. This only works for an administrator of a private instance, with an administrator token. With any other token the call fails.

The administration of the server is also reachable: user accounts, cluster hosts, custom domains, brands, OAuth2 clients, identity providers and proxies. These resource types are marked Administrator and need an administrator token too. An agent signed in as an administrator can change or delete other people's accounts and the configuration of the whole server: keep that profile for administration tasks only.

The temporary token of dashboard development

When an agent develops a dashboard app, thinger_dashboard_dev (and thinger dashboard dev) creates a temporary token so the app on your computer can call the server. That token:

• has full access to your account, or to one project when you develop in the context of a project;
• appears in Access Tokens as Dashboard dev (temporary), with the ID dashboard_dev (dashboard_dev_ and the project when you develop in a project);
• lasts 8 hours by default, and is replaced each time you ask for a new link;
• travels in the link to the app. The link only opens an app on your computer (localhost), unless you allow a remote address with --allow-remote (allow_remote in the tool).

Writes made by the app during development are real. Do not share the link. To revoke the token before it expires, delete it in Access Tokens. See Build dashboards with AI.

The preview links of thinger_dashboard_publish use a read-only token instead.

Good practices

• Give the minimum. Use a token with only the permissions the task needs. Use the username and password sign-in only for work where you trust the agent with everything.
• Use a project as the boundary. A token created inside a project only reaches the resources of that project.
• Confirm what cannot be undone. Deleting a resource, overwriting a file of a storage, removing a plugin or restarting a host acts at once. The MCP server tells agents to ask before they do it; review those calls before you approve them in your client.
• Separate production. Keep production and test servers in different profiles, and do not make the production profile the default. Name it when you mean it (profile in the tools, --profile in the CLI).
• Revoke what you no longer use. Delete tokens of agents you stopped using, and run thinger logout on computers you leave.

Related pages

Access TokensCreate tokens with scoped permissions to call the Thinger.io REST API from scripts, apps and agents, and make them expire.Connect an AI agentInstall the thinger CLI, sign in, and connect Claude Code, Claude Desktop or any other MCP client to your Thinger.io account.MCP toolsEvery tool the Thinger.io MCP server offers to AI agents, with its parameters, and every resource type the agents can reach.