Goody
BUSINESS · COMMERCE & FINANCE
Gift collections, templates, brands, greeting cards, and orders in the account they connected.
Connecting Goody in practice
Goody splits agent access into three permissions and is explicit that only one of them, mcp.gifts, "can spend money" — behind a rolling daily spend limit that applies across every connected tool and token at once, and that the account holder can switch off entirely. Sandbox and production are separate accounts with separate signups and separate keys.
Scopes that draw scrutiny
mcp.giftsSend gifts. Goody calls it out as "the only permission that can spend money", so it is the one permission an approval process should actually gate.mcp.writeCreate and edit contacts and lists, and preview and price gifts. Changes recipient data without being able to send.mcp.readAccount basics, contacts, past gifts and the catalog — which is to say the recipient list and gifting history of everyone the account has ever sent to.
Worth knowing
- Personal MCP tokens are created in Goody for Business account settings with a chosen expiry, and the range runs from 30 days all the way to no expiry, so the convenient option is the one that never lapses.
- The rolling daily spend limit is the real control, and it is account-wide rather than per token: tightening it constrains every connected tool, and the account holder can disable it outright.
- API keys are "scoped to users", and orders an agent creates "show up in your Goody for Business account like orders created from the website", so agent spend is indistinguishable from that person’s own without checking the source.
- Production and sandbox are entirely separate accounts — api.ongoody.com against api.sandbox.ongoody.com, with their own signup and keys — so nothing tested in sandbox carries an ID into production. Neither the Commerce nor the Automation API documents a rate limit.
Checked against MCP authentication and permissions (2026-09-29), Commerce API authentication (2026-09-29), Automation API authentication (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Goody behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.