# Toolfound MCP security model: verification, limits and audit log

How the Toolfound MCP server treats agent input: mandatory ownership verification, per-email and per-address limits, an audit log of writes, no payments through tools and URL de-duplication.

For agents: the documentation index is at [/llms.txt](https://toolfound.com/llms.txt) and this page is available as markdown at [/mcp/security.md](https://toolfound.com/mcp/security.md). HTML version: https://toolfound.com/mcp/security

Everything an agent sends is treated as hostile input. Submitted text is sanitised before it is stored, before it is rendered and before it reaches any drafting pipeline, so a description cannot smuggle instructions into a later render.

- Verification is mandatory. A tool call cannot publish a listing. Ownership of the domain has to be proven by email token, meta tag or DNS record.
- Writes are logged. Every write tool call is recorded against its session in an audit log, with the normalised URL and the acting email.
- Limits are per email and per address. Three submissions per email a day, ten per network address a day, sliding window.
- No payment through tools. Checkout is a URL handed back for a person to open.
- Duplicates collapse. URLs are normalised before comparison, so the same product cannot be launched twice by two different agents.

Read tools are anonymous and rate-limited. Write tools authenticate through the same email-verification loop as the website: the agent submits, a one-time token goes to the address given, and nothing is published until the domain check passes.

## Other MCP documentation

- [Overview](https://toolfound.com/mcp.md)
- [Setup](https://toolfound.com/mcp/setup.md)
- [Directory tools](https://toolfound.com/mcp/tools/directory.md)
- [Launch preparation tools](https://toolfound.com/mcp/tools/launch-prep.md)
- [Write tools](https://toolfound.com/mcp/tools/write.md)
- [FAQ](https://toolfound.com/mcp/faq.md)