Is it safe to give an AI access to my account?

What the key is

Click your profile picture, choose Settings, then MCP & API keys in the left menu, scroll to the MCP keys section and press Create. The form asks for two things: a name, and an expiration date.

Those two fields are all systeme.io documents about setting a key up. Its documentation does not describe any way to limit a key to particular data, to particular features, or to reading without writing.

So nothing in that documentation describes a key covering less than the whole server, for as long as the key lives.

How much the whole server is

113 tools, checked on a live connection on 4 September 2026. 53 of them only read. The other 60 change something, and 12 of those delete something.

A key is issued against all of it. There is no documented way to issue one that reaches fewer.

The limits systeme.io does set

• 90 days. systeme.io states that for security reasons MCP keys are valid for a maximum of 90 days.
• Two keys. An account can hold a maximum of two MCP keys at a time.

How the key travels

Two methods are documented: the key attached to an X-MCP-Key header, or the key included as an mcpKey parameter in the request URL. systeme.io says the dual approach exists because some clients cannot set custom headers.

Both of the published setup guides use the URL. The Claude instructions paste the key into the connector address, and the ChatGPT instructions set the authentication field to No Auth for the stated reason that the key is already in the URL.

systeme.io's own instruction on the matter, in its developer documentation, is to keep MCP keys secure, and it says that failing to do so may lead to significant risks. It does not say what a leaked key would allow, and no revocation step is documented.

The authentication method is not the one they recommend

systeme.io states that the current implementation does not yet support OAuth, which it names as the recommended authentication method.

It says OAuth support is planned, that it will improve security, and that it will remove the need for key expiration. Until then, keys are what exists.

What the connection can destroy or send

The tools are not read-only. Counted off systeme.io's own capability list and the connection behind it, the twelve deletions cover courses, course modules, lectures, email campaigns, campaign steps, newsletters, digital products, physical products, price plans, coupons, automation rules and calendar events.

It can also send a newsletter directly to your audience, not only draft one. The tool is called send_newsletter and it sits beside send_test_newsletter, which sends to you instead.

It cannot delete a funnel or a funnel step. systeme.io states that modifying or deleting funnels and funnel steps through MCP is not supported, and the connection carries no tool for it.

Two things run the other way. The connection carries no tool for deleting a contact and none for deleting a tag, although both systeme.io documents say deletion is available for both.

Where the permission switches actually sit

In the AI tool, not in systeme.io.

Claude's connector panel lists the tools in two groups, read-only tools and write or delete tools. Permissions offered are Always allow, Needs approval and Blocked across the tools, plus a Custom setting so each tool can be configured on its own.

ChatGPT is described differently. systeme.io says that depending on your ChatGPT plan and workspace settings, actions such as create, update and delete may be restricted or may require additional confirmation.

Every one of the six MCP feature articles repeats the same line: the AI will require confirmation prompts depending on the platform being used. systeme.io separately states that for sensitive newsletter actions, scheduling, sending and deleting, the AI asks for confirmation first.

The pattern is that the documented guard rails belong to the client. None are documented on the key itself.

What can be taken back

Deleted contacts are recoverable. They sit in a Recently deleted bin under Contacts for 30 days, with the deletion date and removal method shown, and can be restored from there.

That bin covers a contact deleted anywhere in the account. It is beside the point for MCP, because the connection carries no tool that deletes a contact in the first place.

Nothing equivalent is documented for tags, price plans, coupons, products, courses, campaigns or newsletters removed through the server.

For deleted funnels and blogs, recovery is a paid support request, and only within 7 days of the deletion. That one is context rather than a live risk here, since the MCP server cannot delete a funnel.

A key can be removed at any time

The settings page that issues MCP keys says so in its own instructions: keys can be created for an AI tool and removed again whenever you want. So if a key is shared by accident, or an assistant stops being one you trust, there is a control for it.

The help article does not mention this, which is why it is worth stating plainly. Removing a key was read off the settings page in a live account rather than off a published page, and it was not tested by actually removing one.

What systeme.io does not document

Three gaps are worth knowing about before deciding anything.

• Being told a key was made. systeme.io documents an email notification whenever a new public API key is created on an account. The MCP article says nothing about whether MCP key creation triggers the same alert.
• A scope model. No read-only key, no per-feature key and no per-key restriction appears anywhere in the MCP documentation.
• The tool list itself. systeme.io publishes no inventory of the tools a key reaches. The 113 above came from an account check, because there was no page to read it off.

Those are the facts systeme.io publishes, plus the count it does not. The decision rests on what is in the account and who else can reach the chat window it is connected to.

Why this answer reaches no verdict

I have not told you whether to connect an AI to your account, and that is deliberate. What is above is what systeme.io states, including the places where it states nothing at all, plus the one thing it does not publish: the size of the tool surface.

Where this answer describes an absence, it means the documentation is silent. It does not mean the capability was tested and found missing.