# Honeycomb MCP Server Permissions & Controls, Explained

How the Honeycomb MCP server's controls actually work — the read/write scope split, team-owner-only API keys, the densest native rate limits in this series — and why telemetry itself is the untrusted input on this surface.

# The Honeycomb MCP server control model, explained

The Honeycomb MCP server is first-party and hosted (`https://mcp.honeycomb.io/mcp`, with an EU endpoint at `mcp.eu1.honeycomb.io`), aimed at [Enterprise customers per the official repo](https://github.com/honeycombio/honeycomb-mcp), and unusually broad for a vendor server: roughly 25 read tools and 9 write tools spanning queries, traces, BubbleUp, Boards, Triggers, SLOs, notification recipients, and Canvas investigations, per the [tools reference](https://docs.honeycomb.io/integrations/mcp/tools). Honeycomb has leaned into the agent story harder than most vendors in this series — [MCP integrations for Claude Code, Cursor, and the AWS DevOps Agent](https://www.honeycomb.io/blog/honeycomb-advances-observability-for-ai-powered-software-development), plus its own Canvas Agent — which makes the control model of its front door worth reading closely. Sources: the [configuration guide](https://docs.honeycomb.io/integrations/mcp/configuration-guide) and [tools reference](https://docs.honeycomb.io/integrations/mcp/tools).

*This page covers the server's own controls. For the cross-server picture, see [the MCP server controls comparison](/mcp-controls); for what a control layer adds on top, [the coverage matrix](/coverage).*

## What's at stake on this surface

The read side looks harmless — it's "just telemetry" — and that's exactly the trap. **Telemetry is attacker-writable by design.** Spans and events record what production saw: user-agent strings, request paths, form inputs, log lines, error messages. Anyone who can make your application emit an event can put text into your Honeycomb datasets, and `run_query`, `get_trace`, and `get_span_details` hand that text to the agent as trusted-looking results. Every server in this series has an injection story; this is the one where the payload arrives *pre-loaded into the data plane*, waiting for an investigation to read it. An agent debugging an incident is an agent reading strings an attacker may have chosen — during the exact workflow where it holds the most context and urgency.

The write side is subtler than "it can edit dashboards." Triggers, SLOs, and recipients are **the organization's perception of production**. An agent with `mcp:write` can change what fires, what's measured, and who gets told — silencing an alarm and fabricating green are both two tool calls. And one pairing deserves naming: `create_recipient` registers a new notification destination, and `create_trigger`/`update_trigger` routes alert data to recipients. Two individually reasonable writes compose into a data-egress channel — query results leaving through the alerting pipe to a destination the agent chose.

There's also a delegation edge unique to this server: `canvas_agent_invoke` has your agent send work to Honeycomb's Canvas Agent — an agent invoking an agent, with the second hop running under Honeycomb's roof on your data. Composable autonomy is the product working as designed; it's also a [delegation chain](/what-is-an-agent-delegation-chain) with no chain-level record.

## Auth: OAuth preferred, keys gated to team owners

Two paths, per the [configuration guide](https://docs.honeycomb.io/integrations/mcp/configuration-guide). **OAuth** is the recommended default — "Prefer OAuth in most use cases. Use an API key only when your agent cannot support interactive login." **Management API keys** cover headless agents, and the gate here is real: "Only team owners can generate an API key." Keys are a `KEY_ID:SECRET_KEY` pair passed as a bearer header, scoped at creation to the Model Context Protocol and Environments surfaces, and Honeycomb's docs say the right thing about hygiene: MCP keys should carry no other scopes and never reach source control.

Credit where due — team-owner-only minting is a stronger issuance control than most servers in this series, where any user with an account can create a connection.

## The scope split: a real read-only mode, with an OAuth caveat

The permission model is one clean bit. **Read** is "required for all Honeycomb MCP operations." **Write** (`mcp:write`) is required for every mutating tool — `create_board`, `update_board`, `create_trigger`, `update_trigger`, `create_slo`, `update_slo`, `create_recipient`, `canvas_agent_invoke`, `feedback` — and the docs frame it as protecting "your data from unintended changes." Omit it and the write tools are refused server-side; add Environments scoping and write access is bounded to named environments. As read-only stories go, this sits with [Linear's dedicated endpoint](/mcp-controls/linear) and [Supabase's `--read-only`](/mcp-controls/supabase): enforced at the vendor, not a client-side flag the agent could edit.

The caveat is the OAuth path: "OAuth users get write scopes automatically when they grant write access during the consent flow." The posture is set by a consent click, per user, at connection time — not by an operator policy that outlives it. And below the one bit there is no grain: no per-tool selection, no way to allow `create_board` but not `create_trigger`. Write is a set menu.

## Rate limits: the densest native per-call control in the series

Every tool class carries a stated per-minute limit — 300/min for semantic-convention lookups and Canvas polling, 200/min for discovery, 100/min for query execution and traces, 30/min for update mutations, 20/min for creates, 10/min for `get_service_map` — with rate-limit responses that state when to retry. This is the most granular native rate limiting we've catalogued on any first-party server, and it's the correct instinct: mutations rate-limited an order of magnitude below reads.

Being precise about what it decides, the way we were with [Atlassian's per-call IP check](/mcp-controls/atlassian): a rate limit is a per-call decision about *frequency*. It bounds how fast — never whether. The 19th `update_trigger` of the minute that silences your paging alert passes the same check as the first.

## The audit question, asked of an observability company

The docs we reviewed don't describe an operator-facing audit log of MCP tool invocations — no stated per-call record of which tools fired, as whom, with what arguments, queryable by an admin. If one exists undocumented, we'll gladly correct this page ([the doctrine](/mcp-controls) is to grade what the docs commit to).

What the platform *does* capture is telling: `list_aiconversations` and `get_aiconversation` expose recent AI conversations — event counts, full event timelines — *to agents, as queryable data*. Honeycomb instruments agent sessions the way it instruments everything: as telemetry to analyze. That's genuinely useful, and it is not the same artifact as an audit trail. Telemetry about agent behavior is readable by the next agent (including whatever an earlier, injected session left in it); an audit record of tool invocations is an operator's answer to "what did the agent do and as whom." The company that taught the industry to observe production has, per its docs, not yet stated that it observes its own MCP surface for the operator — which mostly shows how young this surface is: in [our registry-wide scan](/blog/mcp-audit-gap), 74.9% of servers document no audit capability at all.

## What none of it decides

The now-familiar shape of this series. Honeycomb's controls answer *who may connect* (OAuth consent, owner-minted keys), *what surface exists for them* (read/write scope, environment access), and *how fast* (rate limits). No native mechanism answers *whether this call should run*: no approvals, no policy over arguments, no way to hold the trigger-edit that silences an alarm or the recipient-create that opens an egress channel while allowing the hundred routine queries around them. Those calls are in scope, under the rate limit, and indistinguishable — at this layer — from the work you wanted.

That's not a Honeycomb failing; it's the boundary of what a data-plane vendor can see. A per-call decision needs the tool, the arguments, and the session's history, judged against your policy, with the verdict recorded — the job of a control layer in the call path, which is [what this site is about](/what-is-an-agentic-control-plane). Run the two together: Honeycomb's scope split and rate limits as the vendor-enforced floor, a control plane deciding and recording each call above it.