Local AI Automation and Permissions

MaskPilot uses local MCP to expose capabilities that the current desktop client is allowed to provide to an AI caller. The service listens on a local address by default, so the caller and the MaskPilot client must run on the same computer.

Establish the local connection

Sign in to the client and enable MCP, then configure the current bearer token in the caller. The installed client version defines the tool list. Switching accounts or member permissions does not filter that list, but it can determine whether a tool call is allowed.

Permissions follow the signed-in account

AI calls do not bypass team permissions. A member can use only the capabilities granted to the currently signed-in account. If profile assignment or a feature permission is missing, the owner should review the member settings instead of repeatedly changing tool names. For MCP permission required, use the account and team permission checklist to separate the current account, target-resource access, and connection ownership.

Protect the token and troubleshoot in order

Do not place the token in public documentation, screenshots, or logs. For connection failures, check whether the client is running and signed in, then review the MCP switch, local address, and caller configuration. Refresh the current token for an invalid-token response; for an unknown tool, verify the installed client version and the returned tool name.

Topic

In this topic

Follow the guides for setup, then use the matching answer when a message or problem appears.

Guides

AI assistant · Guide Connect local MCP to Codex

Enable MaskPilot local MCP, configure a bearer token, connect it to Codex, and verify local access and the available browser tools.

AI assistant · Guide Manage AI Permissions and Tokens

Keep local MCP calls within account permissions, store the bearer token safely, and verify the tool list for the installed client version.

Q&A

AI assistant · Q&A Fix a Local MCP Connection Refused Error

Use the health endpoint, loopback address, caller environment, and access token to diagnose a refused or failed local MaskPilot MCP connection.

AI assistant · Q&A Fix an “Invalid token” MCP response

Verify the current token, environment variable, and caller process without exposing credentials in logs.

AI assistant · Q&A What does “Unknown tool” mean in MCP?

Use the list returned by the current client, verify the tool name and version, and separate a missing tool from a denied call.

AI assistant · Q&A Fix an “MCP permission required” Error

Separate MaskPilot MCP account access, sign-in state, bearer-token authentication, and resource permissions to recover a rejected local AI automation call safely.