Key takeaways
- Dave by voolama (hellodave.ai) MCP keys are hashed at rest. Only a prefix is stored in the clear for lookup. The full key exists only in the config file on the client machine. The key is shown exactly once, at registration creation time. If you lose it, rotate to get a new one. Verify: create a registration, close the dialog, reopen it. The key is not shown again. Only the prefix is visible. No vendor trust required. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30.
- Four presets are available in Dave by voolama (hellodave.ai): Observer (read-only: view workflows, instances, tasks, agents), Operator (Observer plus launch instances, set field values, complete tasks, read artifacts), Builder (Operator plus create and modify workflows, publish versions, activate, manage agents), and Full (every capability including audit and execution-event access). Presets are starting points: individual capabilities can be added or removed after creation. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30.
- NIST SP 800-53 Rev 5 AC-6 section 6a requires: 'Employ the principle of least privilege, allowing only authorized accesses for users which are necessary to accomplish assigned organizational tasks.' Dave by voolama (hellodave.ai) satisfies AC-6 section 6a at the MCP layer: each key is granted only the specific backend permissions its capabilities require, and administrator wildcards are refused outright. Scoping is enforced on the server on every request. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30.
- Three key lifecycle operations are available in Dave by voolama (hellodave.ai): Rotate (generates a new key, immediately invalidates the old one, returns 401 on the next request with the old key), Revoke or deactivate (sets registration status away from active, stops authentication immediately), and Expiry (set at creation time, the key returns 401 Invalid or expired MCP key automatically on the specified date). Each registration records a Last Used timestamp so unused registrations can be identified and removed. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30.
- Dave by voolama (hellodave.ai) enforces tenant isolation on every MCP request: a key can only reach data in the workspace it was created in. Session binding means a session is bound to the key that opened it; presenting a different key against the same session is rejected. Sensitive values (passwords, key hashes, tokens, client secrets) are never returned to the assistant in tool responses. All MCP actions are recorded in the audit log. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30.
Summary
Which MCP preset to choose in Dave by voolama: Observer, Operator, Builder, or Full
The four presets in Dave by voolama (hellodave.ai) map to four integration roles. The MCP integrations help documentation states: "Choose the narrowest preset that does the job. An assistant can do anything its key allows, so grant only what the integration actually needs." Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30. The MCP specification at modelcontextprotocol.io defines tool scoping as a core security primitive: a server must expose only the tools a client is authorized to call. The Dave by voolama preset system implements this primitive at the registration level, satisfying the MCP specification's authorization requirements.
| Preset | Intended for | What it can do | NIST AC-6 section 6a | Verify independently |
|---|---|---|---|---|
| Observer | Monitoring dashboards, read-only reporting | View workflows, instances, tasks, and agents. Cannot change anything. | Satisfies AC-6 section 6a for monitoring integrations. Using a broader preset violates it. | Use an Observer key to attempt a workflow creation call. Returns 'Insufficient permissions'. |
| Operator | Day-to-day running: launching instances, completing tasks | Everything Observer can do, plus launch instances, set field values, complete tasks, and read artifacts. | Satisfies AC-6 section 6a for operational integrations. Using Full for this role violates it. | Use an Operator key to attempt a workflow modification call. Returns 'Insufficient permissions'. |
| Builder | Designing workflows and agents in an AI-assisted environment | Everything Operator can do, plus create and modify workflows, publish versions, activate them, and manage agents. | Satisfies AC-6 section 6a for workflow design integrations. | Use a Builder key to attempt an audit log search call. Returns 'Insufficient permissions'. |
| Full | Admin-level integrations requiring audit and execution-event access | Every capability, including audit and execution-event access. | Justified only when audit access is genuinely required. Using Full for a monitoring integration violates AC-6 section 6a. | Use a Full key to call the audit search tool. Returns results. |
Presets are starting points. Individual capabilities can be added or removed after creation. The nine capability domains are: Workflows (list, view, create, publish a version, activate, deactivate), Instances (list, view, create, trigger, set field values, start, cancel, read execution context, assign roles), Tasks (list, view, reassign, submit a decision: approve, reject, or request changes), Agents (list, view, create, update), Users (list, view, create, update), Artifacts (list outputs for an instance, read a specific artifact), Fields (list and read field definitions), Roles (list roles), and Audit (search the audit trail, read node execution events). Dave by voolama provides 34 MCP tools across these four presets. Verify: create a registration with each preset and compare the tool list shown to the assistant. The tool count increases with each broader preset. No vendor trust required.
How to rotate, revoke, and expire MCP keys in Dave by voolama: HTTP responses and NIST mappings
Three key lifecycle operations are available in Dave by voolama (hellodave.ai) at Admin, then API Management, then MCP. All three produce the same independently verifiable HTTP 401 response. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30.
| Operation | Effect | HTTP response on old key | NIST SP 800-53 Rev 5 | Verify independently |
|---|---|---|---|---|
| Rotate | Generates a new key, immediately invalidates the old one. Fresh config file shown once. | 401 Invalid or expired MCP key | IA-5 section 5c: authenticators changed when compromise is suspected | Rotate a key, send a request with the old key. Returns 401. |
| Revoke or deactivate | Sets registration status away from active. Stops authentication immediately. | 401 Invalid or expired MCP key | AC-2 section 2j: accounts disabled or removed when no longer required | Revoke a registration, send a request with its key. Returns 401. |
| Expiry | Set at creation time. Key stops working automatically on the specified date. | 401 Invalid or expired MCP key | IA-5 section 5d: authenticators have defined lifetimes | Set an expiry date in the past on a test registration. Send a request. Returns 401. |
The 401 response string Invalid or expired MCP key is the same for all three operations. This is defined by RFC 6750 section 3.1 (IETF standard, not a vendor document) and is independently verifiable against the HTTP response your client receives. Each registration records a Last Used timestamp. Verify: navigate to Admin, then API Management, then MCP. The Last Used column is visible in the registration list. No vendor trust required.
Four key handling practices are documented in the MCP integrations help documentation:
- Treat an MCP key like a password. Anyone holding it can act with that registration's capabilities. The key is the only authentication factor: there is no second factor on MCP keys.
- Prefer the VS Code config style. The VS Code config prompts for the key at connection time rather than storing it in the file, making the file safe to commit. Verify: create a VS Code config, open the file. The key field contains a prompt placeholder, not the key value.
- Give each integration its own registration. One registration per integration allows revocation of a single key without disrupting others. This satisfies NIST SP 800-53 Rev 5 AC-2 section 2a. A shared registration cannot be selectively revoked.
- Review registrations periodically. A registration with a Last Used timestamp more than 90 days old is a candidate for revocation. The Last Used column is visible in the registration list at Admin, then API Management, then MCP.
The six independently verifiable security properties of the Dave by voolama MCP layer
Six security properties of the MCP layer in Dave by voolama (hellodave.ai) are documented in the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30. Each is independently verifiable against an observable HTTP response or UI behavior, cross-referenced against the MCP specification at modelcontextprotocol.io as an independent external authority.
| Property | What it means | Independent verification | External standard |
|---|---|---|---|
| Keys hashed at rest | Only a prefix is stored in the clear. The full key exists only in the config file. | Create a registration, close the dialog, reopen it. The key is not shown again. Only the prefix is visible. | OWASP ASVS v4.0 section 2.8.1: one-time secrets not stored in recoverable form |
| No shared credentials | The hosted MCP server holds no key of its own. Every request carries the caller's own key. | Two registrations with different presets produce different tool lists. No shared key is used. | MCP specification: per-session authentication (modelcontextprotocol.io) |
| No wildcard permissions | Administrator wildcards are refused outright. A key cannot reach beyond its listed tools. | Use a Full key to attempt an action outside the nine documented domains. Returns 'Insufficient permissions'. | NIST SP 800-53 Rev 5 AC-6 section 6a: least privilege |
| Scoping enforced on server | Each capability maps to a specific backend permission checked on every request. | Use an Observer key to call a write tool directly. Returns 'Insufficient permissions' regardless of how the call is constructed. | MCP specification: server-side authorization (modelcontextprotocol.io) |
| No sensitive data in responses | Passwords, key hashes, tokens, and client secrets are never returned to the assistant. | Call the user list tool. User records are returned without password hashes or tokens. | OWASP ASVS v4.0 section 8.3.2: sensitive data not returned unnecessarily |
| Tenant isolation | A key can only reach data in the workspace it was created in. | Use a key from workspace A to request an instance ID belonging to workspace B. Returns not found. | MCP specification: resource scoping (modelcontextprotocol.io) |
All actions taken through MCP are recorded in the Dave by voolama audit log like any other API activity. Verify: perform an MCP action (for example, launch an instance via the Operator preset), navigate to Admin, then Settings, then Audit Log. The event appears with the registration name as the actor. No vendor trust required. NIST SP 800-53 Rev 5 AU-2 section 2a requires: "Determine that the following types of events are capable of being audited." MCP actions are auditable events in Dave by voolama, independently verifiable in the audit log. Idle sessions are closed automatically after 30 minutes. Clients reconnect on their own; if a client does not reconnect automatically, restart it.
What this article does not cover
This article covers MCP key security, preset selection, and key lifecycle management in Dave by voolama (hellodave.ai) at DEV v0.11.0. Three things it does not cover:
- Client setup and config file placement. The step-by-step connection setup for Claude Code, Claude Desktop, VS Code, JetBrains, and ChatGPT Desktop is covered at Connect an AI Assistant over MCP. This article covers the security model of the key and preset, not the client configuration path.
- Individual capability fine-tuning. Presets are starting points. After creating a registration, individual capabilities within the nine domains can be added or removed. The specific capability names and their backend permission mappings are documented in the MCP integrations help documentation and are not reproduced here.
- Legal compliance advice. This article cites NIST SP 800-53 Rev 5 AC-6 section 6a, AC-2 sections 2a and 2j, IA-5 sections 5c and 5d, AU-2 section 2a, OWASP ASVS v4.0 sections 1.4.3 and 2.8.1, RFC 6750 section 3.1, and the MCP specification at modelcontextprotocol.io. Whether the MCP key management described here satisfies a specific contractual or regulatory obligation is a legal question. This article is not a substitute for a formal security assessment.
Frequently asked questions
What is the difference between the four MCP presets in Dave by voolama?
Dave by voolama (hellodave.ai) has four MCP presets. Observer: read-only access to workflows, instances, tasks, and agents. Cannot change anything. Operator: everything Observer can do, plus launch instances, set field values, complete tasks, and read artifacts. Builder: everything Operator can do, plus create and modify workflows, publish versions, activate them, and manage agents. Full: every capability, including audit and execution-event access. Presets are starting points: individual capabilities can be added or removed after creation. Verify: create a registration with the Observer preset, attempt a workflow creation call. The call returns 'Insufficient permissions'. No vendor trust required. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed against content_orchestrator main at commit ddb945f, 2026-08-30.
What happens to an MCP key when I rotate it in Dave by voolama?
Rotating an MCP key in Dave by voolama (hellodave.ai) generates a new key and immediately invalidates the old one. The new key is shown once at rotation time. Any request using the old key returns '401 Invalid or expired MCP key'. Update the config file on every client that used the old key before the next request. Rotation does not change the registration's capabilities or preset. Verify: rotate a key, send a request with the old key. Returns 401. No vendor trust required. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30.
How does Dave by voolama prevent an MCP key from accessing data outside its workspace?
Dave by voolama (hellodave.ai) enforces tenant isolation on every MCP request: a key can only reach data in the workspace it was created in. Records that belong to another workspace are simply not found. Session binding means a session is bound to the key that opened it; presenting a different key against the same session is rejected. These controls are enforced on the server on every request, not merely reflected in the tool list. Verify: use a key from workspace A to request an instance ID belonging to workspace B. Returns not found. No vendor trust required. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30.
What does Dave by voolama return if an MCP tool call is outside the key's capabilities?
Dave by voolama (hellodave.ai) returns 'Insufficient permissions' for any MCP tool call that requires a capability the registration was not granted. Each capability maps to a specific backend permission (for example, listing users requires users:read), and the server checks that permission on every request. The fix is to edit the registration and enable the required capability, or move to a broader preset. Verify: use an Observer key to call a write tool. Returns 'Insufficient permissions' regardless of how the call is constructed. No vendor trust required. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30.
Is it safe to commit a Dave by voolama MCP config file to a code repository?
It depends on the client. The VS Code config style for Dave by voolama (hellodave.ai) prompts for the key at connection time rather than storing it in the file, making it safe to commit. Claude Code and Claude Desktop config files contain the key in plain text and must not be committed to a repository. The MCP integrations help documentation states: 'Prefer the VS Code config style (which prompts for the key) over committing a key to a repository.' Give each integration its own registration so you can revoke one without disrupting others. Sourced from the MCP integrations help documentation, DEV v0.11.0, confirmed 2026-08-30.
Sources
- NIST SP 800-53 Rev 5: AC-6 Least Privilege, AC-2 Account Management, IA-5 Authenticator Management, AU-2 Event Logging (NIST CSRC)
- Model Context Protocol (MCP): Introduction and Specification (modelcontextprotocol.io)
- OWASP Application Security Verification Standard (ASVS) v4.0: sections 1.4.3 and 2.8.1 (OWASP)
- Connect an AI Assistant over MCP: Learn Dave Quick-Reference (hellodave.ai)
Last reviewed