Permissions, Security & Troubleshooting

This tutorial goes deeper on keeping your Everwall MCP connection secure — choosing the right permissions, reviewing and revoking access, and following a few sensible habits — and then walks through the errors you’re most likely to run into and how to fix them.

---

Choosing the right permissions

When you connect, you decide what the AI is allowed to do. The golden rule: grant the least you need.

If you want the AI to…	Grant
Answer questions and pull stats, but never change anything	Read Only
Work your moderation queue	Moderate Posts (and Read is included)
Clean up captions, tags, and pins	Edit Posts
Run announcements	Manage Announcements
Run the agenda	Manage Agenda
Run polls	Manage Polls
Manage the web form source	Manage Content Sources
Post via third-party integration	Everwall Connect
Do it all (trusted assistant)	Full Access

Remember: every non-read permission already includes read access, so you never need to add Read Only on top of another scope. And a connection can be restricted to specific walls, which is ideal for agencies or teams that want to hand an AI agent one event without exposing the whole account.

The permission ceiling

A connection can never do more than you can. If your own Everwall login is view-only on a wall, a tool you connect is view-only on that wall too, even if you grant the Moderate scope. Everwall clamps every authorization to your actual access, both when you sign in and on every request. That makes it safe to connect tools freely: they inherit your limits, never a way around them.

Reviewing and revoking access

You don’t need an API key, every tool signs you in with the Everwall login flow (see Connecting Your AI Tool). Each tool you connect becomes an authorization on your account that you can review or pull at any time:

• Your own authorizations: account.everwall.com/my-api-keys — see everything you’ve connected, with its name, scopes, and last-used date, and revoke any of it instantly.
• Everything authorized for an account (owners/admins): account.everwall.com/account-api-keys — review and revoke authorizations across the whole account for any user (you must be an admin on the account to see this page and revoke access).

Revoking takes effect immediately across every tool using that authorization, so if a laptop is lost or you’re finished with a tool, pulling access is one click. API access is available on every account — there’s no plan gate.

Advanced / headless use: for scripts, CI, or unattended automation that can’t open a browser, Everwall supports long-lived API-key tokens (they start with ewut_, are shown only once, and are stored hashed). Most people never need one. Get in touch if you have a headless case.

Security best practices

• Grant the narrowest scope that works. Connect a stats dashboard with Read Only; save Moderate or Full for a trusted assistant. You can always reconnect with more later.
• Restrict to specific walls when you can. Handing an agent one event is safer than exposing the whole account.
• Connect one tool at a time. Separate authorizations for “Claude Desktop” and “the Slack bot” mean you can revoke one without disrupting the other, and the last-used date tells you which is which.
• Review access periodically. Skim your authorizations at account.everwall.com/my-api-keys (or the account-wide list) and revoke anything you no longer use.
• Revoke the moment a device is lost or a tool is retired — it takes effect immediately.
• Rotate a leaked Everwall Connect code by disabling and re-enabling Connect, which mints a fresh one.

Troubleshooting

Tool errors come back as a clear code and message so the AI can often correct itself. Here are the ones you’ll actually see, and what to do.

“The AI can’t see a tool it should have”

The tool list is snapshotted when your chat starts, and Everwall ships new tools often. Ask the AI to run ping — it reports the current tool list. If the tool is there but the AI can’t call it, reconnect or refresh tools in your AI tool (in Claude, the Connectors menu has a refresh option), or start a new chat.

Authentication errors

Code	Meaning	Fix
unauthenticated	No token, or it’s invalid/expired/revoked.	Reconnect: in Claude/ChatGPT disconnect and reconnect the connector; in Claude Code run /mcp; in Codex run codex mcp login everwall.
token_expired	Your sign-in has expired.	Tools refresh automatically — if it doesn’t, reconnect using the steps above.
token_revoked	The authorization was revoked.	Reconnect to approve a fresh one.

Permission errors

Code	Meaning	Fix
invalid_scope	Your authorization doesn’t include the permission this action needs.	Reconnect and grant the matching scope (e.g. Moderate to move posts).
account_access_denied	Your login can’t reach this account.	Confirm you’re working in an account you belong to; check with your account owner.
wall_access_denied	Your login (or a wall-restricted authorization) can’t reach this wall.	Confirm the wall is one you’re allowed to touch; a wall-restricted connection only reaches its allowed walls.

Not-found and input errors

Code	Meaning	Fix
wall_not_found	No wall matches the ID/permaslug given.	Re-run list-walls to get the correct identifier.
post_not_found	The post ID doesn’t exist (or already moved).	Re-list the queue; counts and posts move quickly.
queue_invalid	An invalid queue name was used.	Valid queues are moderated, displayed, stashed, blocked.
validation_failed	The tool arguments didn’t pass validation.	The message says which field — the AI will usually retry correctly.
conflict	The change collided with the current state (e.g. deleting an announcement that’s still showing).	Follow the hint in the message — often “hide it first, then delete.”

Rate limiting

Code	Meaning	Fix
rate_limited	Too many calls too fast for this credential.	Wait a moment; the AI will usually retry automatically. Sustained limits are ~120 reads and ~30 writes per minute.

Server / upstream errors

Code	Meaning	Fix
upstream_error / upstream_unavailable	Everwall’s backend returned an error or was briefly unreachable.	Retry shortly. If it persists, get in touch.
internal_error	Something unexpected on the server.	Retry; if it keeps happening, send us the request ID from the error.
session_not_found	The connection session expired (e.g. after a server update).	Your tool should reconnect automatically; if it’s stuck, start a new chat.

Note: Every error includes a request ID. If you report a problem, include it — it lets us find the exact call in our logs.

Still stuck?

If you’ve checked your permissions and connection and something still isn’t working, get in touch with the request ID and a description of what you asked the AI to do. And revisit How the MCP Server Works if you want a refresher on sign-in and scopes.