Permissions and limits
Two separate controls decide what a connected client can do: your account settings and the token it connected with. A request has to satisfy both.
The account setting is the ceiling
In Settings, Features, MCP there is a master switch and a list of destructive actions. Everything starts off.
The master switch is the blunt control. With it off, the endpoint refuses every request, from every client, including ones already configured. Turning it off is the fastest way to cut off access without touching tokens.
Below it, each destructive action has its own switch: moving notes to Trash, deleting folders, rewriting content, renaming things, and so on. Turn on only what you want a client to be able to do.
An action you leave off is not offered to the client. It is not that the client asks and gets refused; the capability is absent from the list it can see. A client that never sees a capability will not propose a plan built around it, so you do not get a confident multi-step suggestion that dies partway through.
There is no confirmation step. This is the important difference from Notate’s in-app assistant, which can show you a card and wait for you to approve. Over MCP there is no Notate window to show anything in, and AI clients do not reliably prompt on their own. So anything you switch on here can run without asking you first. The settings screen says this too.
A token can only narrow it
Each token can carry its own, smaller set of permissions. That lets you give one client less than your account allows.
The rule in both directions:
- A token can be narrower than your account setting
- A token can never be wider
So a token created with everything enabled still cannot delete notes if you have deletion switched off at the account level. Switching an action off applies everywhere at once, whatever any token says. Conversely, a read-only token stays read-only even if your account permits everything.
In practice: give a client you trust less a narrower token, and keep the account setting as the backstop for all of them.
Revoking
Revoke a token in Settings, Features, MCP. It stops working immediately and the others are unaffected.
Revoking stays available whatever your plan is. If you subscribe, create tokens, and later downgrade, you can still see and revoke them, so a credential you handed to another piece of software never becomes impossible to withdraw.
Limits
Two limits protect your account from a client that misbehaves or loops.
Per minute. 120 tool calls a minute without AI, 240 with it — the higher budget follows AI itself, so it applies on the AI plan and equally on Sync with your own provider key. This catches a burst. A client that hits it is told to retry shortly.
Per month. 25,000 tool calls in a calendar month. This catches something different: an agent left running unattended for days at a rate that never trips the per-minute limit. It resets at the start of each month, and a client that reaches it is told when it will reset.
These are protective ceilings rather than an allowance you are billed against. Ordinary use, even heavy use, does not come close.
What is not covered
Notate does not currently show you a running count of your MCP usage in the app, so there is no way to see how close you are to the monthly limit before a client reports hitting it.