FoodPerfect Docs

Docs / Reference

View as MarkdownPlain text for LLMs Open in ClaudeAsk about this page Open in ChatGPTAsk about this page llms-full.txtAll docs in one file

Security and data

#What a connected agent can access

An API key opens one FoodPerfect account, the one that created it, and only through the tools its scopes allow. Through those tools an agent can see:

  • account plan, subscription status and balance
  • Brand DNA: voice, pillars, goals, post types
  • your generated images and videos, uploaded assets and reel templates
  • scheduled posts and their status

It can't see payment details, your password, other users' data, or your social accounts' login tokens. Social accounts are connected through our publishing partner and the tokens never pass through the MCP server. Comments and DMs aren't available over MCP.

#What leaves FoodPerfect

When your agent calls a tool, the tool's results go to your agent's provider (for example Anthropic, OpenAI or Cursor) under your agreement with them. FoodPerfect doesn't control how they process it. Connect FoodPerfect only to AI providers you trust with your brand's content.

Inside FoodPerfect, tool calls are handled exactly like actions in the app, by the same subprocessors: image and video generation providers, our publishing partner, and Google Cloud.

#How keys are protected

  • Keys are random 256-bit secrets with an fp_live_ / fp_test_ prefix. We store only a SHA-256 hash.
  • Keys can be scoped, given an expiry, and revoked instantly.
  • Each key has its own rate limit, and every call is logged with a request id.
  • All traffic is HTTPS.

Report a vulnerability or a leaked key to security@foodperfect.ai.

#Your responsibilities

  • Keep keys secret. Anything done with your key is treated as done by you, including spending your balance and publishing.
  • Review what your agent publishes. Approval tokens exist so a human can say yes, and it's up to your agent setup to ask you. See Approvals.
  • Only publish content you have the rights to, including anything imported with scrape_trending_hooks.

#Terms that apply

Using the API and MCP server is covered by the same terms as the app: