Roam Research

Yes. Two of the tools are delete_page and delete_block, and Roam's own repository warns in a caution block that changes may be difficult or impossible to undo, because Roam has no undo history that reverses bulk operations or deletions made through the API. Both tools carry destructiveHint true. Back up your graph before connecting one with write access.

Anthropic lists 20, and Roam's own source pins the hosted surface at 18. A test file in Roam's public repository names the exact 18 tools the hosted server registers, and it excludes list_graphs and setup_new_graph. Roam's architecture doc says the hosted server writes its own versions of those two, so 20 is plausible and 18 is the graph-content surface.

Yes, if anything references it. Roam's delete_block description states that deleting a referenced block replaces those references with its text, and calls this graph surgery rather than string removal. Deleting a page removes the double-bracket links to it from every block that linked there. So one delete call can edit pages you never named.

Only identity claims. Roam's authorization server advertised four scopes on 2026-08-22 — email, offline_access, openid and profile — and none of them describes graph access. Nothing at the OAuth consent screen separates reading a page from deleting one. The real limit is the per-graph access level you pick separately, outside the OAuth grant.

Yes, but not through OAuth. Roam's connect flow offers three levels — read-only, read-append and full — chosen per graph rather than per connector. Roam's source also names a fourth tier, read-edit-own, which lets an agent edit or delete only content it created, and a code comment states this tier is enforced server-side by the hosted MCP only.

Partly. Blocks tagged with the AI-hide or private tags, and everything nested under them, are omitted from six read tools. Roam states plainly that this is a convenience filter and not a security guarantee, because datalog_query reads the database directly and skips the filter. Roam also warns that template previews are not filtered at all.

Whichever graphs you connect, and the whole of each one. Access is granted per graph, so a graph you never connect is unreachable. Within a connected graph there is no folder or page-level scope in the tool schemas — search, datalog_query and get_page address any page in it, minus the hidden-tag filter that datalog_query bypasses.

By the author name. Anthropic's directory entry states every change Claude makes is attributed to a distinct AI author in your graph. Roam's source corroborates this: a comment in the tool registry says get_graph_guidelines may provision a display page named for the user with an AI suffix when the grant allows writes. Filter on that author to review AI edits.

Append only. Roam's changelog describes an append-only variant of its agent guidance built for encrypted graphs, and states that such connections get get_graph_guidelines and append_to_daily_note only. So on an encrypted graph the connector can capture new notes into a daily page but cannot edit, move or delete existing content.