MCP is not open yet. These pages are ready for when it opens. You can make an agent key now; it starts working when MCP opens. Until then the address below does not answer.
Spend and privacy with Adaver MCP
This page says what an agent can spend with your key, how you stay in control, what the agent sends to Adaver, and what Adaver keeps. The facts come from the server code.
What costs money
| Tool | Cost |
|---|---|
list_presets | free |
get_balance | free |
vectorize_image | 1 image per finished trace |
- Your account's one free image counts as a normal image. It needs a verified email.
- If a trace fails, or takes too long, or the agent goes away before it ends, the image is given back.
- A refusal never costs anything (bad input, a limit, an error).
- A retry with the same
idempotency_keyis free (up to 2 times, within 1 hour). See Safe retries. - Prices for images are on the pricing page.
How you stay in control
| Control | Where | What it does |
|---|---|---|
| Daily limit ("Images per day") | Account page → Agent keys → Make a key, or Edit | The most images one key may spend in one day: 1 to 200, default 20. A day is the UTC day (the default setting). After that, calls answer daily_cap_reached with the time it resets, and nothing is charged. Raising the limit asks for your password. |
| Permissions | When you make the key | Leave out "Turn images into vector drawings" (vectorize) and the key cannot spend anything. It can still read presets, and the balance if it has balance. |
| Expiry | When you make the key | Never, 30 days, 90 days or 1 year |
| Confirm mode | Not on the account page yet | The key gets a price quote first and charges only after the user says yes. See Confirm mode. Keys made on the account page have it off. |
| Revoke | Account page → Agent keys → Revoke | The key stops at once. A call already running may finish. |
Watch your spend:
- Ask the agent "Show my Adaver balance" (the
get_balancetool). - The account page lists each key with its daily limit and when it was last used.
- Every finished trace says
"charged": trueorfalse.
What the agent sends to Adaver
| Sent | Why |
|---|---|
Your agent key, in the Authorization header | To know whose account it is |
The image: its bytes as base64, or an https address that Adaver downloads | To trace it |
| The preset and options you chose | To trace it the way you asked |
An idempotency_key or confirm_token, if the agent sends one | Safe retries and confirm mode |
Tracing runs on Adaver's own engine. Your images are not sent to an AI drawing model. Each image is checked automatically for content we do not trace (Azure AI Content Safety). A refused image costs nothing, and a key that sends several of them in an hour is paused until the hour ends. If the check cannot be made at that moment, the image is traced anyway.
When you send an image_url, Adaver's server downloads it. The address must be public and https. Adaver refuses private and internal addresses.
What Adaver keeps
| What | What is in it | How long |
|---|---|---|
| Your agent key | A one-way hash of the key and its last 4 characters. Never the key itself. | Removed 30 days after it is revoked or expires, or when you delete the account |
| A record of each charge | Your account, the time, that 1 image was used. No image data. | Part of your billing history |
| Retry record (idempotency) | A random id, a fingerprint of the image and settings (a SHA-256 hash that cannot be turned back into the image), whether it was charged, and a request id | Deleted after 24 hours |
| Confirm quote (confirm mode only) | The key's id, the same kind of fingerprint, the time | Deleted after 24 hours |
| A big SVG answer (over 100 KB) | The SVG, your account, its size, a request id, and a SHA-256 hash of the link's secret part (never the link itself) | Until the link ends, 15 minutes by default. Then it is deleted. |
| One log line per tool call | The tool name, the result code, whether it was charged, the time it took, a request id, your account id and the key's id | As long as our hosting keeps logs |
Not kept: the image (bytes, base64 or address), the small SVG answers, the tool arguments, the key, the confirm token, the link. None of these is written to our logs.
An SVG link is secret. Anyone who has the address can read the SVG until it ends. No key is needed. Do not paste it where others can see it.