> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usebench.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and limits

> Understand credentials, evaluation usage, and reviewable write actions.

## Your account, your permissions

MCP authenticates to Bench with your account or a scoped Bench API key. A client cannot use MCP to bypass repository access, tenant isolation, key limits, or evaluation quotas.

Prefer hosted sign-in when your client supports it. For a local server or automation, create a key on the MCP page in Bench. Keys are shown once. Keep them in personal client configuration or a secret manager, not in a repository, prompt, screenshot, or chat.

## Local environments

Use the `BENCH_API_BASE_URL` supplied by the environment that created your key. A local key will not authenticate against the production API. Do not copy production credentials into a test account.

## Actions with consequences

| Action                        | Consequence                                                         |
| ----------------------------- | ------------------------------------------------------------------- |
| Account and result inspection | Reads information available to your credential                      |
| Repository scan               | Reads authorized source code and stores discovery results           |
| Start or resume evaluation    | Uses evaluation allowance and model compute                         |
| Open prompt PR                | Writes a branch/change and pull request in the connected repository |

Ask your coding agent to get confirmation before spending evaluations or creating pull requests. A reviewable candidate is not an applied, deployed, or independently validated fix.

## Context and trustworthy results

Business rules define intended behavior. Traces describe observed behavior; they are not automatically correct. Feedback on a single case must not silently become a rule for every case.

Saved evaluations retain their context and artifact references. New information informs a future bench, not a silent rewrite of historical scores. Unknown or unscored checks should remain visible and must not be treated as passed tests.

## Revoke a connection

Revoke API keys in **MCP → Manage keys and permissions**. Remove the MCP entry from clients that no longer need access. If a key appears in a chat, screenshot, or repository, revoke it and issue a replacement.