What should a session be allowed to do?
A session can make selected operations available for an account. Choose the one read operation needed and inspect the actual tool list the session exposes. Check the provider authorization and correct account separately. A read-only tool can still disclose the information it reads.
What should you price and check about data?
For SDK and MCP use, check Composio’s Platform pricing. It counts tool executions and delivered trigger events separately. The current Hobby plan stops at its included allowance. Pro can use credits and bill extra usage. Check which rates apply to your signup date and which data controls your plan provides. Keep your own permitted operation list and plan how to remove a connection when it is no longer needed.
Would a fictional assistant only read the sample folder?
Draw one invented test account and a session intended to list sample file names.
- Write the exact allowed actionPut one read action and the demo account on the paper plan.
- Review the session outputList the names you expect and leave editing or sharing outside the session.