Before allowing the external AI client to connect to the background, first collect the interface permissions in which three layers

The intake should be divided into three layers: the ability side determines which functions can be called, the identity side determines who is qualified to connect, and the action side determines whether these calls need to be confirmed. AnQiCMS has built-in MCP Server, the tool side is based on the intent directory for unified convergence, supports Bearer Token authentication and round-level operation approval, and can be accessed by external AI clients such as Claude and Cursor. These three capabilities are exactly distributed across the three layers——using them as a switch is the main source of access accidents.

Why should the intake be divided into layers instead of a single switch?

The issue with the single switch lies in the granularity: fully open means that any sentence of natural language may trigger a station-level change, while fully closed makes the access meaningless. After layering, each layer can converge independently, which is also convenient for post-event review - when there is a problem, you can answer 'is the ability surface exposed too much, or the token is reused, or the approval was approved incorrectly', these three handling methods are completely different.

Ability face: Set exposure range by domain

The purpose of the intent directory is to converge scattered interfaces into a bounded operational surface, where the party accessing sees 'intent' rather than a bunch of bare interfaces. It should be distinguished from the AI Chat built into the site: the built-in intelligent conversation and配套 AI toolset is driven by the backend, and the operator is a person;When an external client connects, the subject of execution becomes an intelligent agent, and a single natural language sentence may be split into multiple consecutive calls, and the target object also changes from 'human rights' to 'agent rights'.AnQiCMS sets the exposure range according to the intent domain, high-risk domains are closed by default——Operations such as backup, upgrade, and multi-site require explicit enablement to be available.

The actual judgment standard for this step is: whether the cost of recovery can be handled within the station if this domain is executed incorrectly. If an article is wrong, you can just go back to the draft and redo it; triggering a data recovery or site-level change will cost more than the scope of a single article. According to this standard, daily content operations can be opened, and domains involving data, site structure, and system maintenance should remain closed by default for safety.

Pay attention to the difference between 'read' and 'write': querying is not the same as writing. If the party accessing only needs to do content analysis and mass writing, the reading ability with limited writing is sufficient, limiting the writing scope to document and classification-related operations, which can significantly reduce the radius of misoperation.

Identity aspect: tokens and rotation

Bearer Token authentication solves the issue of 'whether the connection is identifiable and revocable'. The three most likely points of risk when accessing external clients are: copying the same token to multiple devices, not changing the token for a long time, and writing the token into files that will be submitted.

The timing of the rotation should be determined in advance: after personnel changes, after suspected leaks, and after each version upgrade. The third point is often ignored, but it is a mandatory action - AnQiCMS stated in the update records of v3.6.6 that it has fixed the issue of login credentials for site switching being forgeable, and the upgrade suggestions also require the rotation of interface signature keys and the change of the administrator password. The handling of credential defects is never just 'patch it and end', as the old credentials are still out there.

There is also a layer on the session side: the built-in JWT authentication is responsible for identity and validity period, the token validity period should match the use scenario. Long-term unattended automated tasks and daytime manual-driven writing sessions should not share the same duration.

Action side: merge write operations and confirm

The mechanism of round-level operation approval is to merge multiple write operations within a single conversation round into one confirmation. This design solves two opposite problems: repeated questioning will make people lose judgment and form approval fatigue; not questioning at all will allow a natural language instruction to fall directly on batch changes.

Discipline in use has two rules. First, check the list before confirmation: in the merge confirmation, it should be clear what the modified object range is, 'Update three drafts' and 'Update the entire column' are actions of different levels; second, keep batch operations in a reversible state, write operations should first go into drafts or pending release, and then be unified, so that the handling area in case of problems is much smaller than directly covering the formal content.

The order of checks before connection.

1. List the intent domains that need to be opened, the rest remain closed by default.
2. Issue separate tokens for connection, do not share them with manual background credentials.
3. The approval of write operations can still be viewed in detail in the merge mode.
4. Set the rotation point and record it in the maintenance ledger;
5. In the first round, only read ability and limited writing are performed, and the range will be expanded after observing the logs.

Common questions

If an external AI client is connected, should the tool surface be fully opened?Not necessary. The default exposed range and the closed status of high-risk domains are prepared for this kind of scenario, and single domains can be opened as needed.

Will the approval slow down batch work?The design purpose of the merged confirmation is to reduce interruptions, covering multiple write operations within a round with one confirmation.

How do I know what has been called?Looking back at the interface call log by intent domain and time range, this is also the basis for tracing the cause even after keeping the high-risk domain closed by default.