Why are high-risk operation domains closed by default when an external AI client accesses the backend interface?

Why should the high-risk operation domain be turned off by default when integrating an external AI client into the background interface? Because the model is not an operator, and its call does not have the self-correction ability of 'sliding a finger'. A misinterpreted target command will be executed continuously along the tool chain to an irreversible step. The AnQiCMS built-in MCP Server can be accessed by external AI clients such as Claude and Cursor, so the security design of the interface cannot be copied directly from the 'background permissions for people'.

What the client can see is determined by the directory.

The MCP tool layer is organized based on a unified intent directory: intents registered in the directory can be discovered and called by the client; unregistered intents do not exist for the client. This is different from the approach of 'leaving all interfaces open and relying on authentication to block', which assumes that the caller knows what they should not call, while the former assumes that the caller will only see what they are authorized to see.

The convergence of the tool surface also brings a side effect: the client's choices become fewer, and the probability of the model choosing the wrong tool decreases accordingly. The more interfaces there are, the more semantic entries are similar, and the easier it is for the model to pick the wrong one among two similar capabilities.

Which domains are not opened by default

The directory sets the exposure range according to the intent domain, the domain of the site-level operation is closed by default, and it needs to be explicitly enabled before it is visible to the client.

The reason for defaulting to off is not that 'these features are dangerous', but that the impact radius of these actions covers the entire site: backup strategy changes, version upgrades, cross-site configuration distribution. Once executed incorrectly, the cost of recovery is far higher than correcting an article.

Why merge write operations confirmation

The round-level approval handles a different type of risk: the model initiates multiple write operations consecutively within the same round. It seems safer to confirm each one individually, but it actually leads to habitual agreement. When merged into a single confirmation, the approver sees the complete intention of the changes for this round, and can judge whether these actions are reasonable when executed in advance.

There is also authorization: the interface uses Bearer Token verification, and the token is only granted to the required domains. When giving a long-term token to the client, the scope of authority is more worthy of tightening than the validity period.

What is usually called in the public interface layer?

Looking at the distribution of interface document and online calls, high-frequency capabilities are concentrated in content reading and interactive writing: document list and details, classification and tags, image upload, comments and reviews, friend links, system settings and contact information. For batch entry, go through the document content import interface /api/import/archive, which supports querying whether it already exists by title to avoid duplicate import.

These interfaces share the same set of permission boundaries with the AI channel. When AI Chat and built-in skills are arranged within the product, they also follow the same directory, and there will not be a gap where internal tools have more permissions than external clients.

Common questions

Question: Will the AI assistant become useless if it is turned off by default?Answer: No. The capabilities needed for daily content and SEO maintenance are all in the open domain, and the default off setting is only for site-wide operations. It can be manually turned on and off as needed.

Question: What should I do if the token is leaked?Answer: Invalidate and rotate first, while checking the call records during the validity period of the token, focusing on whether it has reached the intent of the site settings.

Question: Can different clients be assigned different permission domains?Answer: It should be like this. Writing clients should only be given content domains, operational drills should be opened with temporary authorization separately, to avoid a single token carrying all purposes.