An agent never changes an instance in one call. It plans the change, the server checks the plan, and only then does it run. What an agent may run is what you give it on the Tools tab and in Connect Agents
MCP clients can still ask you before a call with their own permission prompts. The IDE adds no dialog of its own
Plan, then run
The agent plans
A plan tool, such as intellijsfcc_upload_plan or intellijsfcc_code_version_activate_plan, checks the request and returns a preview: the files and actions, the code version, the instance and its kind, the sizes, what will be overwritten or deleted, and warnings. Nothing changes yet
It names the plan to run
intellijsfcc_mutation_execute names the plan. Every other detail comes from the plan, so the agent can't change a target between the preview and the run
The server checks it again
The plan must belong to this project and to the agent that made it, be under 15 minutes old, match its preview and never have run. The active connection, code version and site must be the same and the files it read unchanged. The tools and each instance must still be open to the agent, checked again just before the run
The agent gets the result
The answer says what changed and how to undo it where it can, such as the code version that was active before. Then the agent checks its work
Planning needs SFCC with plans or higher. Running a plan needs SFCC full, or Custom with Everything, see Presets
What the server checks
| Check | What it does |
|---|---|
| Tool access | The preset and the tool checkboxes on the Tools tab apply to every agent. An agent's own tools and instances in Connect Agent can only narrow them |
| Arguments | Every call is checked against its tool's schema. Wrong or unknown arguments get invalid-arguments |
| The plan | Its owner, age, preview and the state it was made in, as above |
| Limits | 120 calls and 10 writes a minute for each agent session, and one write at a time on each instance |
Production takes no code
Production doesn't take code straight from an IDE, so uploads, deploys, creating or deleting code versions and turning on auto upload are answered unsupported. Code reaches production through replication from staging. Activating a code version on production works like on any other instance
Every upload, deploy, delete and activation an agent makes shows in B2C Sync Log with the agent's name, such as MCP: Claude Code. Sent by Agents finds them
Stop everything
| To | Do |
|---|---|
| Allow reads only | Turn on Block Writes Now on the Tools tab, or in Tools › Salesforce B2C Commerce › B2C MCP. Queued writes don't start and plans that haven't run can't run |
| Disconnect every agent | Click Stop B2C MCP Server in the tool window's title bar |
| Cut off one agent | Select its session on Activity › Sessions and click Disconnect |
The audit log
Every call that writes or plans a write is kept in the audit log: planned, allowed, blocked, run or failed. Each entry holds the time, the agent, the tool and its risk, the plan's paths, hosts and code versions, the effect the agent expected and the result. It is kept for 90 days in <IDE system folder>/intellij-sfcc/mcp/audit/, one file a month. Activity › Audit shows it, see Activity
Untrusted data
Log lines, WebDAV files and debugger values can hold text that anyone wrote, such as a message logged by a shopper's request. The server hands them to the agent marked as data, never as instructions, and never builds its own hints from them
Credentials never pass
- Tools see only whether a credential is set, never its value. User names are never returned either
- No tool has an argument for a credential or takes a URL, so a credential can't be sent anywhere else
- Every answer is scanned. A stored credential or a value that looks like one is masked as
••••••••and the rest of the answer stays - Credential and key files are refused on read, download and upload, and upload plans leave them out
- Plans, the audit log and analytics hold paths and hosts, never credentials
Errors agents may report
| Error | What it means |
|---|---|
invalid-arguments | The arguments don't match the tool's schema |
plan-expired | The plan is older than 15 minutes. The agent plans again |
plan-used | The plan already ran |
plan-fingerprint-mismatch | The plan doesn't match its preview |
plan-drift | The connection, code version, site or files changed since the plan |
risk-not-allowed | The Tools access, the agent's own tools or instances, or Block Writes Now leaves the call out |
unsupported | The instance can't take it, such as code on production |
rate-limited | Too many calls or writes in a minute. The agent waits |