Agent security
Why we sandbox agent access to your board
A feedback board is public on purpose. That makes it useful, and it means an agent should treat what it reads there as untrusted user input.
The boundary
Your public roadmap is not an agent instruction channel.
A post can be useful context for work without becoming a command. We keep those two things separate.
The risk
Public input deserves a visible boundary.
If an agent treats a board post as an instruction, anyone who can post can try to steer an agent with real access. That is a risk worth naming plainly.
What happened on our side
We run our own roadmap through the same public board and agent workflow. During review, we found that public post content needed a stricter boundary before it could inform an executing agent. We paused that path, rebuilt it around bounded data, and verified the rebuilt fetcher against the live board on July 27, 2026.
What we changed
Useful access, deliberately bounded.
Posts are data, not instructions
The agent-facing work queue receives a bounded descriptor: id, title, votes, and status. Free-form post bodies do not cross that boundary as executable task instructions.
Keys carry the smallest useful scope
An automated agent uses its own API key instead of a human session. Read-only keys are GET-only, so a planning agent does not also hold write authority.
Hostile content is part of the test
The queue pattern includes a canary that proves a deliberately malicious post is withheld before it can become an executing agent instruction.
You choose the status grant
A key with only the propose scope can create a pending proposal, but cannot patch a post directly. Nothing changes on the public board or notifies voters until a board owner confirms the proposal in the dashboard. A write-scoped key can patch the status directly, including a status that notifies voters. Give an agent the scope that matches the authority you intend to grant.
Verify it yourself
The source is public because the boundary should be inspectable.
The hosted server forwards the caller’s scoped key; it does not add ambient authority of its own. You can inspect the implementation and the proposal-confirmation rule directly.
Read the MCP server source
The official FeatureJet MCP server is public under the MIT license, including its caller-scoped authorization model and proposal-confirmation flow.
Questions, answered
Choose the public status authority deliberately.
Can an agent change a public board status by itself?
It depends on the key scope you choose. A key with only the propose scope can create a pending proposal, but cannot patch a post directly. Nothing changes on the public board or notifies voters until a board owner confirms the proposal. A write-scoped key can patch the status directly, including a status that notifies voters.
What can a read-only FeatureJet key do?
A read-scoped key can use GET endpoints to inspect its organization’s board data. It cannot create, edit, delete, publish, or change status.
What reaches FeatureJet’s agent-facing work queue?
The factory work queue passes a bounded descriptor containing a post’s id, title, vote count, and status. It does not pass free-form post bodies as task instructions.
Want the setup details? Read the hosted MCP server guide or see how the agent work queue fits into a reviewed delivery loop.