# MCP security and troubleshooting

Treat the local and cloud MCP endpoints differently. Desktop loopback is intended for programs on the same computer, while the cloud endpoint requires authenticated requests.

![MCP security and troubleshooting](https://www.foxora.ai/docs/images/v5.0.8/reference/settings-mcp-server.webp)

*Studio interface in English. Sample data.*

## Verify a failed connection

1. Recopy the JSON from `Settings` → `MCP Server`.
2. On Desktop, confirm Foxora is running and the client uses `http://127.0.0.1:4097/mcp`.
3. On web, confirm the client sends the current Foxora session token as an `Authorization: Bearer` header.
4. Reload the client and inspect its server log for connection or authentication errors.
5. Confirm the discovered tools are limited to read, document, search, glob, grep, UI-source lookup, and web access.

## Expected result

The server connects with the correct boundary; shell and file-writing tools never appear through this endpoint.