they give us their MT4 credentials (broker , login and password)
I wonder what is the purpose of collecting passwords? Do you want the "copy tool" to work at your server location impersonating different users (slaves)?
I would expect the "copy tool" could be a kind of MetaTrader plugin/addon, which works at user PC allowing immediate supervision and manual control/confirmation. In this case the tool just need a feed from a master account (or from several of them).