The bird stays on your branch.
What a connection to your assistant can read, change and use, and what stays out.
A connection signs in as you and uses your Dr. Canary account’s permissions. It can read your account, change a saved shopper, and request a check. Your assistant’s app controls approvals.
Can and cannot
A connection can:
- Read your sites, Groups, saved shoppers, checks, inquiries and reports.
- Create or edit a saved shopper, set its calendar, pause it or retire it.
- Request a check, which may send permitted test inquiries and use your allowance.
A connection cannot:
- Do anything your account cannot do in Dr. Canary.
- See other accounts, hidden prompts or internal notes.
- Request a check for a site your account is not connected to.
- Return your sign-in credentials, payment records or support messages.
- Override your assistant’s app’s approval controls.
What you see before you approve
Every setup ends at the Dr. Canary sign-in. The page names your assistant’s app, says where sign-in returns, and lists what the connection can do. You choose Allow connection or Deny.
Dr. Canaryaccount connection
Connect ChatGPT
This connection uses your full Dr. Canary account permissions.
With this plugin
- Read your account
- The sites, saved shoppers, checks and reports you can already access. Groups, site tools, journeys, inquiry details and their available evidence use the same account access.
- Manage secret shoppers
- Create or edit saved shoppers your account can manage; set their calendar or retire them. Settings include their name, departments, test-inquiry choice, frequency and pause.
- Request site checks
- Request site or authorized Group checks using existing saved shoppers. The basic site check uses the first saved shopper that has not been retired, including a paused shopper.
Checks may submit test inquiries and use your current allowance.
Signing in
- Sign-in is OAuth 2.1 with PKCE, started by your assistant’s app.
- The connection asks for one scope,
mcp, and uses your Dr. Canary account. - You sign in to Dr. Canary in the browser. No password or token is ever pasted into a chat.
- Dr. Canary recognises the published identities of ChatGPT, Codex, Claude and Claude Code.
- With Codex and Claude Code, start sign-in and finish it on the same device.
What it can read
The sites, saved shoppers, checks and reports your account can already access, and the Groups, site tools, journeys, inquiry details and available evidence that go with them.
It reads what the report shows. A record your account cannot open is refused with not_found.
What it can change
- Create or edit a saved shopper your account can manage: its name, departments, test-inquiry choice, frequency and pause, and its areas of focus.
- Set a shopper’s calendar, or retire it. Retiring stops its future checks; its recorded checks remain.
- Settings changes affect future checks. Saving does not start a check.
- Changing a shopper needs an owner or admin role and monitoring on the site.
What a check can use
- A check may use your current allowance.
- A check may send test inquiries, and only where the saved shopper submits them. A shopper that looks only sends none.
- The basic check uses the first saved shopper that has not been retired, including a paused one.
- Asking twice can start two checks and use allowance twice.
- When the allowance does not permit another check, the request is refused with
quota_exhausted.
What stays out
- Other accounts, hidden prompts and internal notes.
- Your sign-in credentials, payment records and support messages. The tools do not return them.
Who approves a change
Your assistant’s app. It follows its own approval controls for changes and checks.
Dr. Canary marks every change and every check as a write, not a read, so the app knows which calls change something.
Disconnecting
- Disconnect from your assistant’s connection settings. In ChatGPT, open Settings › Plugins › Dr. Canary, then the account’s more-options menu, and choose Disconnect.
- In Codex, a server added from the terminal signs out with
codex mcp logout dr-canary. - Uninstalling a plugin and disconnecting the account are separate steps.
- Disconnecting does not delete information your assistant’s app already received.
- Disconnecting stops the app using the connection. It is not a promise that a session already issued ends at that same moment.
Limits on use
Burst protection allows 60 tool calls per verified user per rolling minute, on each server instance. It is not your check allowance.
A call past it is refused with rate_limited and the seconds to wait in retryAfterSeconds.
Privacy, terms and help
The privacy notice says what an assistant’s app receives through the connection. The terms cover inspections and reports.
Questions, privacy requests and complaints go to the contact the privacy notice names: tom@drcanary.com.
What it does not do
- A check request names a site, not a shopper, a journey or a web address. The basic check uses the first saved shopper that has not been retired.
- A queued check is not a finished check, and a finished check is not a published report.
- A one-time checkup does not unlock changing saved shoppers or requesting checks.
- Reconnecting does not grant access, monitoring or allowance your account does not have.
Ask your assistant
More examplesWhich Dr. Canary sites can you see?
list_sites
Show my saved shoppers and whether I can edit them.
list_assignments
Before you request a check, tell me which shopper it uses and whether it sends test inquiries.
list_assignments
Questions
Is it safe to connect Dr. Canary to my assistant?
The connection signs in as you with OAuth 2.1 and PKCE and uses your account’s permissions. You see what it can read and change before you approve it. No password or token goes into the chat.
Can my assistant spend my allowance?
A check may use your current allowance and may send test inquiries where the saved shopper submits them. Saving a shopper does not start a check. Your assistant’s app controls approvals for checks.
Can it see other stores or other accounts?
It sees the sites your account can already access. Other accounts stay out. A record your account cannot open is refused with not_found.
Can my assistant change things without asking me?
Changes and checks follow your assistant’s app’s approval controls. Dr. Canary marks each one as a write, so the app knows it changes something. How the app asks is set in the app.
What does my assistant’s app receive?
The app receives the tool responses, which can include site selectors, saved shoppers and schedules, recorded checks, reports, findings and available evidence. It handles them under its own terms and privacy policy. The tools do not return sign-in credentials, payment records or support messages.
How do I disconnect?
From your assistant’s connection settings. In ChatGPT, open Settings › Plugins › Dr. Canary and choose Disconnect from the account’s menu. Disconnecting does not delete what the app already received.
Do I need a paid plan?
Reading needs access to a site. Changing saved shoppers and requesting checks needs monitoring on that site; a one-time checkup does not grant them. A new account asks list_sites and is shown where to go next.
Give your assistant something to read.
A checkup is one report. Monitoring keeps the bird shopping your site on a schedule, so there is a fresh report every time you ask.