Your Pet-Care Agent Should Ask Permission
An agent that can explain pet care is useful.
An agent that can see the right vaccination record, update the right pet, and then prove that the update actually happened is something else entirely.
It is also much more dangerous if the boundaries are vague.
Today we released the production Meo Mai Moi MCP gateway, together with a portable Meo Mai Moi MCP skill. OAuth-capable agents can now connect to Meo Mai Moi, discover the tools available to them, and help with real pet-care work.
But the important part is not that an agent can act.
The important part is that it has to ask permission first.
From Conversation to Care Work
The gateway exposes 172 semantic tools across 26 OAuth scopes. They cover the ordinary user-facing parts of Meo Mai Moi:
- pet profiles, photos, lifecycle details, and microchips
- weights, vaccinations, medical records, and habits
- pet sharing, placement requests, helper profiles, and messages
- groups, shared ledgers, expenses, and receipts
- notifications, invitations, locale, and profile settings
That is a large catalog, but tool count is not the point. The useful unit is a task a person already understands.
You might ask an agent to show the latest weight records for a pet, check which vaccinations are coming up, prepare a new habit, or inspect shared care expenses before recording a receipt. The agent discovers the relevant tools and their schemas instead of guessing at URLs or improvising data structures.
Meo Mai Moi remains the system doing the real work. MCP gives the agent a clearer door to knock on.
Permission Is Part of the Product
Connecting does not require copying a personal API token into a chat or configuration file.
The MCP client starts an OAuth flow. You sign in to Meo Mai Moi, see the client identity and requested areas of access, and approve or deny the connection. The resulting grant is limited to those scopes and can be revoked.
A pet-profile read is not permission to send messages. Reading health history is not permission to change finances. A consent screen should describe an actual boundary, not serve as a ceremonial obstacle before unlimited access.
Behind that screen, the gateway keeps two credential layers separate. The MCP client receives its own opaque credentials. It never receives the delegated Meo Mai Moi credential used by the gateway, and client-facing tokens are stored only as digests. Refresh credentials rotate, replay revokes the grant family, and the delegated credential is encrypted at rest.
Those details are deliberately boring. Good security often is. Their purpose is simple: a useful connection should not require a person to casually handle reusable secrets.
A Write Is a Claim About Reality
Reading a pet record and changing one are not equivalent actions.
For writes, the gateway and Meo Mai Moi use several layers of restraint:
- The agent reads the current resource and resolves a stable identifier.
- Updates use the version that was actually read, allowing Meo Mai Moi to reject stale changes.
- Each intended write uses an idempotency key, so an uncertain retry does not quietly create a duplicate.
- Meo Mai Moi applies its normal ownership, membership, and domain rules.
- The result is read back through the normal API before the agent claims success.
This matters for a weight entry. It matters more for a medical record, an invitation, shared access, a financial transaction, or the final stages of a placement request.
Tool descriptions can advise an agent to behave carefully, but prose is not a security boundary. The real boundaries are scopes, permissions, stable targets, concurrency checks, rate limits, and server-side product rules.
The Gateway Is Not a Second Meo Mai Moi
The MCP service is intentionally a thin adapter.
It owns OAuth for MCP clients, protocol translation, input normalization, and deliberately narrow responses. It does not own pets, people, placements, ledgers, or the rules connecting them. Every tool calls a documented user-facing Meo Mai Moi endpoint, where the application checks the delegated permission and the user’s access again.
Our test for a gateway feature is straightforward: could Meo Mai Moi enforce this rule without trusting the gateway? If the answer is no, the rule belongs in Meo Mai Moi before the tool ships.
Administrative endpoints, impersonation, browser sessions, identity operations, and internal services are not exposed merely because they exist. MCP is a new interface to appropriate product capabilities, not a tunnel through the application.
A Skill for Agents, Without Secrets
The accompanying portable skill teaches compatible agents how to connect, request narrow scopes, discover current state, handle structured failures, and verify consequential writes. It works with Codex, Cursor, OpenClaw, and other clients that understand the SKILL.md format.
The skill contains no credentials and does not ask users to paste tokens. It is also available through ClawHub as @troioi-vn/meo-mai-moi-mcp.
This is different from the earlier OpenClaw skill. That integration helps an agent use the REST API with a personal token managed by the user. The new MCP skill connects to a remote MCP gateway through OAuth. Both are useful, but they are intentionally separate authorization models.
Try the Connection
The production Streamable HTTP endpoint is:
https://mcp.meo-mai-moi.com/mcpAn OAuth-capable client can connect there, complete consent, discover its tools, and begin with a narrow read such as list_pets.
We want agents to reduce the clerical weight around care without becoming another source of risk or confusion. That means giving them useful capabilities, but also making them identify themselves, ask for the access they need, work through the same rules as everyone else, and verify what they changed.
Intelligence is welcome.
Permission is required.