# Is It Safe to Connect AI to Your Tesla?

> Exactly what an AI assistant can and can't do with your Tesla through mytesla.io: 40 fixed tools, no driving, Tesla OAuth scope as the ceiling, and what we do and don't store.

It's the right question to ask before giving any assistant access to your car.
The honest answer: it's as safe as the access model behind it — and mytesla.io
is built so the AI can never do more than a small, fixed set of things you've
explicitly allowed. Here's exactly how it works, what the AI can and can't do,
and what we do and don't keep.

## The short version

- The AI can only call **40 fixed tools** — climate, charging, locks, alerts,
  navigation sharing, and a few security toggles. **There is no "drive" tool.**
- Your access is granted through **Tesla's own OAuth consent screen**. We never
  see or store your Tesla password.
- The **scope you approve on Tesla's screen is the hard ceiling.** mytesla.io
  can't request anything beyond it.
- We **don't store your location, drive history, or charge history** beyond the
  live request, and we **don't sell data or train models** on it.

## What the AI can actually do

mytesla.io is a [Tesla MCP server](/tesla-mcp-server): a bridge that exposes a
fixed list of Tesla Fleet API commands as tools. Your assistant can call:

- **Climate:** start/stop, set temperature, defrost, seat and wheel heaters.
- **Charging:** start/stop, set limit, schedule charging and departure.
- **Access:** lock/unlock, trunk/frunk, windows, sunroof.
- **Alerts & navigation:** honk, flash lights, share a destination.
- **Security toggles:** Sentry Mode, Valet Mode, speed limit (PIN-protected).
- **Status reads:** vehicle state, battery, location for a live "where's my
  car" answer.

That's the whole surface. The AI can't invent new capabilities, and it can't
reach parts of the Fleet API we don't expose — even if the underlying API
supports them.

## What the AI can't do

- **It can't drive the car.** No steering, acceleration, or Autopilot/FSD
  control — there is no tool for it.
- **It can't exceed your Tesla consent.** Tesla's OAuth scope is the ceiling.
- **It can't bypass PINs.** Anything PIN-protected (like Valet Mode) still
  requires the PIN you set.
- **It can't quietly escalate.** The 40 tools are fixed regardless of what your
  assistant asks for.

## How the connection is authorized

You never give mytesla.io — or the AI — your Tesla login. Instead:

1. You click **Connect Tesla** and land on **Tesla's own consent screen**,
   where mytesla.io appears as "Embay, LLC."
2. You approve the specific scopes there. That approval is what authorizes
   commands — and it caps what's possible.
3. You register a **virtual key** on the car once, so the vehicle trusts
   commands signed by mytesla.io through Tesla's Vehicle Command Protocol.

Every command after that is a **signed request through Tesla's official Fleet
API** — the same secured path Tesla's own app uses. Nothing here relies on a
scraped session token or an unofficial API.

## What we store (and don't)

- **We don't store** your vehicle's location, drive history, or charge history
  beyond serving the live request.
- **We don't sell** your data.
- **We don't train** AI models on your conversations or vehicle data.
- We keep what's needed to run your account, subscription, and the credit
  ledger. Full detail is in our [privacy policy](/privacy).

## Sensible precautions

Connecting AI to your car is safe when you treat it like any account:

- Use an assistant and account you control and trust.
- Review what you're approving on Tesla's consent screen.
- Set PINs for sensitive functions (Valet Mode, speed limit) so even you
  confirm them deliberately.
- You can **revoke access anytime** from your Tesla account's third-party apps
  settings — that instantly cuts mytesla.io off, no matter what any AI wants.

## FAQ

**Can the AI accidentally drive my car or turn on Autopilot?**
No. There is no driving tool of any kind. The AI can only run the 40 fixed
commands, none of which move the car.

**Do you get my Tesla password?**
No. Authorization is through Tesla's OAuth flow. We never receive your
credentials.

**Can a bad prompt make it do something dangerous?**
The worst any prompt can do is call one of the 40 allowed tools — the same
things you can do from the Tesla app. PIN-protected actions still need the PIN.

**How do I turn it off?**
Revoke mytesla.io in your Tesla account's connected-apps settings, and/or
remove the connector from your AI assistant. Either one stops it.

## Next steps

- [The AI assistant for your Tesla](/tesla-ai-assistant)
- [What is a Tesla MCP server?](/tesla-mcp-server)
- [Privacy policy](/privacy)
- [Get started at mytesla.io →](https://mcp.mytesla.io/signup?src=guide-safety&plan=driver)