Check what your agent can access
Artur Sabirov2 min readRevised September 7, 2026. Product details reflect this revision.
Suppose you want an agent to inspect a failed deployment in Lessly. Before asking it to investigate, connect the client and check the access behind that connection. A successful sign-in tells you the credential works. It does not tell you whether its permissions fit the task.
The useful first step is a read-only request that lets you see what the connected client can reach.
Connect the client
Add https://mcp.lessly.com as a remote server in a client that supports MCP over HTTP. The connection guide describes two authentication methods.
An interactive client can open a browser for OAuth approval and receive a short-lived token. A headless client can use a static API key as a bearer credential instead.
Choose the method your client supports, then check which identity the credential represents. Putting a credential in an agent's configuration does not, by itself, create a separate agent identity.
Understand a personal key's reach
A personal API key authenticates as the user who created it. The product attached to the key is the default product for requests that do not select another one.
That default is not a restriction. A request can select a different product if the key's owner has access to it. Naming a key after one project does not change this behavior.
For the failed-deployment investigation, this means checking the owner's access before handing over the key. Read the API-key documentation if you intend to use that method. Do not assume that a key created while viewing one product is limited to that product.
Make a read-only first call
Ask the connected agent:
List the Lessly products I have access to.
The platform returns the products available to the authenticated identity and its role in each. Check that list before selecting the product with the failed deployment.
Once a product is selected, the MCP tool list shows the operations available to that identity in that product. Inspect the operations the investigation needs. Reading a list successfully does not establish that the credential is read-only; it may also permit changes.
Decide whether this connection fits the work
Product selection tells the platform where to direct a request. It is not a substitute for a permission restriction.
If the credential permits more than you intend to give the agent, resolve that before assigning the investigation. The point of the first call is to replace an assumption about access with something you can inspect.
Related posts
Building Lessly in the open
Follow along, and get early access to the private beta.