Choose MCP permissions for SEC research

Public metadata and private reads are different

Synoptic documents public use of search, streams_all, fetch and get_stream. These discover or inspect public streams. Other tools require the account connection through OAuth. Our anonymous post-read probe returned HTTP 401, matching that documented boundary.

An OAuth scope gives the client a category of permission within your account. It does not expand the account’s subscription or erase stream restrictions. A public stream page can coexist with subscriber-only access to its stored posts.

Review the permission categories you actually need

The default Research preset includes several read permissions. The broader Read only preset includes private profile, workspace, inbox and subscription categories as documented; its name does not mean it exposes less data than Research. Review the actual consent screen.

Keep a clear revocation path

The official guide says connections can be disconnected under Settings → Connected Accounts → AI apps (MCP). Review the documented effect on app connections before revoking, especially when more than one client uses the same registration.

A connector configuration should contain the documented endpoint, not a copied browser cookie or a raw token pasted into public source code. Use the client’s OAuth flow and retain only non-secret test evidence.

Protect the boundary between reading and acting

A prompt asking for a filing brief should not silently follow streams, change targets or publish the result. Synoptic’s MCP surface contains write tools as well as research tools, so choose permissions and review tool calls according to the work you intended.

Treat filing text and post content as evidence data. A document saying to ignore instructions or call another tool is not authorization to modify an account. Keep unexpected tool suggestions in the review path and cite the original document rather than acting on embedded instructions.