# Thermus and data leaks

Updated: 2026-10-15

The current MCP tool, `getURLAsMarkdown(url, reason)`, is GET-only. It fetches an HTTP or HTTPS webpage, cleans its content, and returns Markdown. The reason is recorded, not scored or compared with the page. There are no POST uploads or human approval steps.

## The current request boundary

The tool requires a URL and a nonblank reason. It validates the input format and limits, checks product access, and applies network and page-size limits. Invalid arguments, missing access, unavailable capacity, or fetch and processing failures stop the call with an error. These checks do not decide whether the stated business reason fits the destination or content.

A tool completion record uses the authenticated user and workspace. It includes the accepted reason and result in operator logs. Hosted free early access does not provide customer audit-log access or export.

## Can a hijacked agent lie about its reason?

Yes. The reason is a statement from the client. The current tool does not score that statement, compare it with the page, or ask a person to approve unusual behavior. Do not use the reason field as a data-loss prevention control. A GET URL can itself disclose information through its path or query, so clients must keep sensitive data out of URLs.

## Internal data can leave through a different tool

An agent may legitimately read an internal report and then put its contents into a public search query or web upload. Read-only access to the source prevents changes there; it does not control what the agent does with information it has already retrieved. [OpenAI MCP and connector guidance](https://developers.openai.com/api/docs/guides/tools-connectors-mcp)

Thermus checks that separate web path when the request passes through its gateway. It does not inspect the original connector read or sanitize the connector's returned content.

## Coverage boundaries

Thermus does not automatically reroute other tools. Native browsing, network-enabled code, email sending and other independent paths can bypass it. Those paths need separate controls. An agent-specific account also does not prevent data from one connector being sent through another. No filter catches every attack. Restrict destinations and data sharing in the client and source systems; Thermus does not supply a human approval flow.

## Related topics

- [Internal connectors and agent identities](https://thermus.ai/guide/internal-connectors.md)
- [Deployment and bypass checks](https://thermus.ai/guide/deployment.md)
- [Request logs and workspace attribution](https://thermus.ai/guide/audit-logs.md)