> ## Documentation Index
> Fetch the complete documentation index at: https://www.quo.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security best practices

> Use Quo MCP safely with trusted clients, explicit action confirmation, and careful handling of customer data.

Quo MCP can read customer communications and perform real-world actions. Treat an MCP connection like access you would grant to a teammate who can view your inbox and text customers.

## Use the official server

Connect only to Quo's hosted Streamable HTTP endpoint: `https://mcp.quo.com/mcp`.

Verify the hostname before authorizing. Do not enter your Quo credentials into a page opened from an MCP URL on another domain.

## Connect only clients you trust

A connected client can ask Quo MCP to access anything exposed by the available tools and permitted by the Quo account that authorized the connection. The client may also send tool results to its own model provider, logs, plugins, or other connected systems.

Before connecting a client:

* Verify its publisher, download source, privacy policy, and data-retention settings.
* Review its enabled MCP tools and approval settings.
* Prefer Quo's official Claude or ChatGPT connector when using those products.
* Do not connect a shared client under a Quo account with broader access than its users need.

For a dynamically registered third-party client, Quo shows the client-reported name and the redirect host before forwarding you to Quo authorization. The name is self-reported and is not proof that Quo verified the client. Continue only if you started the connection and recognize the destination.

## Require confirmation for write actions

Configure your MCP client to ask before any action that changes data or contacts someone outside your workspace.

| Action                     | Tools                                                      | What to confirm                                                                             |
| -------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
| Send a message             | `send-message`, `send-group-message`, `send-bulk-messages` | Sender, every recipient, each recipient's final content, cost, and shared-thread visibility |
| Create or change a contact | `create-contact`, `update-contact`                         | Correct contact, fields to change, and fields to clear                                      |
| Create or change a task    | `create-task`, `update-task`                               | Title, assignee, due date, completion state, and linked record                              |

Message sends are irreversible and use prepaid messaging credits. A bulk send can partially succeed, so review its result before retrying; otherwise, recipients who succeeded on the first attempt may receive a duplicate.

<Warning>
  `send-group-message` exposes every recipient's phone number to everyone in the shared thread. Use `send-bulk-messages` when recipients should receive separate private messages.
</Warning>

## Treat tool results as untrusted content

Messages, call transcripts, voicemail transcripts, contact fields, and task descriptions can contain instructions written by an external person. Those instructions are data, not authorization.

This matters because an attacker can place text in customer-controlled content that attempts to redirect the AI client—for example, telling it to ignore your request, disclose other conversations, or send a message. This is a form of prompt injection.

To reduce the risk:

* Tell the client to treat all Quo content as untrusted input.
* Do not let retrieved content authorize another tool call.
* Review proposed writes and any data leaving Quo.
* Limit a task to the smallest relevant inbox, contact, and date range.
* Start a new client session if retrieved content appears to be steering the assistant.

## Understand account-limited access

Quo MCP uses the Quo account selected during OAuth authorization. It can access only what that account can access, but it does not create an additional permission boundary inside that account.

Use a Quo user with the narrowest practical workspace and inbox access. If a client is used by several people, do not assume the client will reproduce Quo's per-user controls outside Quo.

## Protect OAuth credentials

During authorization, your Quo password is entered only on Quo's hosted sign-in page. The MCP client receives OAuth tokens rather than your Quo password.

If you are building a client:

* Store access tokens, refresh tokens, and dynamic-registration credentials in a secure credential store.
* Never log tokens or include them in prompts, URLs, source code, or error messages.
* Persist the newest rotated refresh token atomically and serialize refreshes for a grant.
* Use the exact registered redirect URI and S256 PKCE.
* Treat `invalid_grant` as a signal to discard the failed grant and ask the user to authorize again, not as a retry loop.

## End or repair a connection

Use the MCP client's **Disconnect**, **Remove**, or **Clear authentication** action to stop using a connection. Reconnect and complete OAuth again if:

* You authorized the wrong Quo account.
* The client reports an expired or revoked grant.
* You no longer trust how the client stored its credentials.
* You see activity you do not recognize.

If you suspect unauthorized activity, stop using the client and contact [Quo developer support](mailto:support+developers@quo.com).

## Related guidance

* [Connect to Quo MCP](/docs/mdx/mcp/connect)
* [Supported tools](/docs/mdx/mcp/tools)