# Limit what AI assistants can see

> Keep an AI assistant connected over MCP to one app, a few hosts, a filtered view or highlighted requests, so other apps' traffic stays out of its context.

Source: https://docs.subcloak.com/cloak-proxy/automation/assistant-scope/

Added in Cloak Proxy 0.5.1.

When an AI assistant is connected to Cloak Proxy's [MCP server](https://docs.subcloak.com/cloak-proxy/automation/mcp-server/), it can read everything you've captured. That's a lot more than the app you're working on: your browser, chat apps, and anything else going through the proxy. The **assistant scope** keeps the assistant to the traffic you choose, such as one app, a few hosts, a filtered view or the requests you highlight. You can also decide whether it gets bodies at all.

Cloak Proxy applies the scope itself, to every tool, resource and prompt the MCP server offers. The assistant can see what the scope is, but it can't change it.

*[Screenshot: Settings, AI Assistants page: Limit what AI assistants can see is on, the apps list has ShopApp, the hosts list has api.example.com and *.shopapp.example, requests in the scope are set to Metadata only, everything else is Hidden, and a line says what assistants see now. Settings › AI Assistants with the scope limited to ShopApp's API hosts, metadata only.]*

## Set the scope

1. Open **Settings › AI Assistants** (or press <kbd>⇧</kbd> <kbd>⌘</kbd> <kbd>A</kbd> and type `assistant`).
2. Turn on **Limit what AI assistants can see**.
3. Add what the assistant may see. Each kind you fill in narrows the scope further, and within a kind any entry counts:
   - **Apps**: app names or bundle IDs, as the traffic list shows them. Pick from **Seen Apps** or type one.
   - **Hosts**: an exact host such as `api.example.com`, or `*.example.com` for its subdomains (not `example.com` itself; add both if you need both).
   - **Query**: a [typed query](https://docs.subcloak.com/cloak-proxy/inspect/query-language/), such as `status:5xx -path:/health`. **Use Current View** turns the front tab's sidebar selection and filters into one.
   - **Only requests I highlight**: right-click requests in the traffic list and choose **Highlight** to share just those.
4. Choose what the assistant gets of **Requests in the scope**: **Full requests and responses**, or **Metadata only**.
5. Choose what happens to **Everything else**: **Hidden** (the default) or **Metadata only**.

The page shows how many requests the assistant sees right now. The scope applies at once, to assistants that are already connected too.

### Faster ways in

| From | Choose | The scope becomes |
|---|---|---|
| An app in the sidebar, or a request in the list | **Limit AI Assistants to ShopApp** | That app |
| A host in the sidebar | **Limit AI Assistants to api.example.com** | That host |
| A tab's menu, or the query bar's menu | **Limit AI Assistants to This View** | The tab's sidebar selection and filters, as a query |

Choose the same item again (**Stop Limiting AI Assistants to ShopApp**) to turn the scope off. Its settings are kept for next time.

While a scope is on, a capsule in the status bar says so, for example **Assistants: ShopApp**. Click it to open the settings.

*[Screenshot: The main window with the traffic list and inspector; in the status bar, an Assistants: ShopApp capsule between the paused-at-breakpoint count and the macOS traffic item. The status bar shows when assistants are limited.]*

## Metadata only

With **Metadata only**, the assistant gets each request's method, URL, status, timing, sizes and headers, and nothing it would need a body for:

- Request and response bodies, WebSocket messages and stream events are left out. `get_request` says a body was withheld and gives its size.
- Credentials in the URL and headers are replaced with `REDACTED`, even if **Redact sensitive data before sending to AI** is off.
- Tools that work on bodies, such as `generate_types`, `get_protobuf`, `get_stream_events`, `build_replay_flow` and Map Local from `rule_from_request`, say the bodies aren't shared.
- Searches, `trace_value` and typed queries only look at what the assistant can see, so they can't be used to find out what a body contains.

Use it when the assistant needs to know which calls an app makes and how they went, but not what's in them.

## What the assistant sees

| | In the scope | Outside it, Hidden | Outside it, Metadata only |
|---|---|---|---|
| `list_requests`, `cloak://requests/recent` | Listed | Left out, with a count: *(12 requests hidden by the assistant scope)* | Listed without bodies |
| `get_request`, `get_request_curl`, `cloak://requests/{id}` | Full, or metadata only | Refused | Without bodies |
| Tools that take a request id (`replay_request`, `edit_and_replay`, `compare_requests`, `annotate_request`, `rule_from_request` and others) | Work | Refused: *Request #12 is outside the assistant scope the user set in Cloak Proxy* | Work, except those that need bodies |
| Searches and reports (`search_requests`, `trace_value`, `insights`, `llm_calls`, `privacy_map`, `get_trace`, `check_contract`, `export_session`) | Included | Left out | Included without bodies |
| Counts (`proxy_status`, `list_apps`, `list_domains`) | Counted | Not counted; `proxy_status` says how many are hidden | Counted |

A few things work on all your traffic and can't be limited, so they're off while a scope is on: `clear_session`, `start_live_share` (and share links in `list_live_shares`), `contract_report` (use `check_contract`), `mirror_report` (use `compare_environments`) and script logs. The Doctor (`diagnose_capture`) leaves out findings about apps and hosts outside the scope, and browser console messages are shown only when the scope is limited by host alone.

The security tools keep to it too. The [AI security](https://docs.subcloak.com/cloak-proxy/security/ai-security/#from-an-assistant-mcp) tools (`prompt_injection`, `mcp_manifests`, `review_mcp_manifest`, `ai_guard_log`) leave out findings and guard entries for requests outside it, and MCP servers seen only there, and refuse ids outside it. `list_findings` and `export_findings_report` withhold evidence from requests outside it (and its bodies, where the scope shares metadata only), and `add_finding` only takes requests the assistant may read in full. See [Findings and reports](https://docs.subcloak.com/cloak-proxy/security/findings/#ai-assistants).

Requests an assistant sends through Cloak Proxy count as the request they copy: a replay of a ShopApp request is in a ShopApp scope. A new request it makes up with `edit_and_replay` can only go to a host in the scope.

The scope covers captured traffic. Your [API client](https://docs.subcloak.com/cloak-proxy/api-client/overview/) collections, environments and history aren't captured traffic, and assistants can use them as before. Cloak Proxy's own tools and rules (Map Local, breakpoints, scripts) still work on all traffic.

## Tell the assistant

The MCP server's instructions say what the scope is when an assistant connects, so it doesn't keep asking for requests it can't have. The read-only tool `assistant_scope_status` (and the `cloak://assistant-scope` resource) gives the details: each scope, who set it, and how many requests are visible, metadata only and hidden.

```json title="assistant_scope_status"
{
  "active" : true,
  "summary" : "Assistants see ShopApp · api.example.com, *.shopapp.example as metadata only; everything else is hidden.",
  "requests" : { "visible" : 41, "fullBodies" : 0, "metadataOnly" : 41, "hidden" : 1286 },
  "scopes" : [ { "apps" : [ "ShopApp" ], "hosts" : [ "api.example.com", "*.shopapp.example" ], "inScope" : "metadata", "outsideScope" : "hidden", "setBy" : "the user, in Cloak Proxy" } ]
}
```

No tool can change the scope, and `update_settings` refuses to.

## Limit one connection with flags

`cloakctl mcp` takes flags that narrow the scope for that connection only. Use them in a project's MCP config so that project's assistant keeps to its own app, whatever you set in the app for others:

| Flag | Narrows it to |
|---|---|
| `--app NAME` | That app (repeat it, or separate names with commas, for several). |
| `--host HOST` | That host, or `*.example.com`. |
| `--scope QUERY` | Requests matching the [typed query](https://docs.subcloak.com/cloak-proxy/inspect/query-language/), such as `'app:ShopApp status:5xx'`. |
| `--metadata-only` | Metadata only, for everything it can see. |

**Claude Code**

```bash title="Terminal"
claude mcp add cloak-proxy -- "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl" mcp --app ShopApp --metadata-only
```

**JSON**

```json title=".cursor/mcp.json"
{
  "mcpServers": {
    "cloak-proxy": {
      "command": "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl",
      "args": ["mcp", "--app", "ShopApp", "--metadata-only"]
    }
  }
}
```

Flags only narrow. A request has to pass both the scope in Settings and the connection's flags, so `--app OtherApp` with the setting limited to ShopApp shows nothing, and `--host` can't bring back what the setting hides. **Settings › AI Assistants** has copyable commands with your current scope already written as flags.

A query that depends on things an assistant could change, such as highlight and extract rules (`col:`, `rule:`, `tag:`, `is:highlighted`) or contract results, can't be a scope: use **Only requests I highlight** instead.

## On Linux

The scope works the same in the Linux app. Set it on the **MCP and AI Assistants** page, under **Assistant scope**, and use the same `cloakctl mcp` flags.

> **What the scope is, and isn't:**
> The scope decides what Cloak Proxy's MCP server hands to an assistant. It isn't a sandbox: an assistant that can run commands on your Mac can read whatever you can, including running `cloakctl show` itself. For agents with a shell, keep your client's approval prompts on for commands, or run them where they can't reach your account.

## Related

  - [MCP server for AI assistants](https://docs.subcloak.com/cloak-proxy/automation/mcp-server/): Connect Claude Code, Cursor and others, and what they can do.
  - [MCP tools reference](https://docs.subcloak.com/cloak-proxy/automation/mcp-tools-reference/): Every tool, with assistant_scope_status.
  - [Agent skills and setup tools](https://docs.subcloak.com/cloak-proxy/automation/agent-skills/#redact-sensitive-data-before-sending-to-ai): Redact sensitive data before sending to AI.
  - [Query language](https://docs.subcloak.com/cloak-proxy/inspect/query-language/): The typed queries a scope can use.