A script starts with no reach at all. The Allowed Tools picker in the Agent editor lists every tool each connected server actually offers, and you tick the individual ones this agent may call. A script with nothing ticked can do arithmetic and nothing else — no server is even started for it.
Every call it does make lands in the Audit Trail with its arguments and its outcome, and a call to a tool you did not grant is refused by name rather than quietly going missing, so a denial reads as a decision rather than a typo. Turning the master automation switch off stops a script that is already running at its next tool call, not merely at its next tick.
"Run now" in the Agent editor runs the script once, immediately, against a workspace you choose, and shows you the log and every call back. Its calls are real — it is a dry run of the schedule, not of the effects. To rehearse the logic on its own first, grant nothing, run it, and read the log.
Treat a script as code you have read. It is yours, it runs on your machine with the reach you gave it, and the sensible habits are the ordinary ones: grant the narrowest set of tools that does the job, start it with an interval long enough to watch, and read the first few runs before leaving it alone.
Connecting a brand-new tool server to scripts is a deliberate, hands-on step — it means naming a program on your machine for Frontier to start, so it is something a person does on purpose in Settings, never something an agent should write on your behalf. The same goes for hand-writing a Connector spec. If you are asking an agent for help here, ask it to explain the change and make it yourself.