Security and data handling

This page is written for someone evaluating MCP Studio against a policy rather than someone setting a server up. It states what the platform enforces, what it retains, what it deletes, and where independent assurance currently stands.

Audience	Security reviewers, IT, and anyone connecting non-public content
Related	Private MCP servers, Adding sources, Uploading files
Questions this page does not answer	Email zair@appatools.com

MCP Studio is currently in beta. Read the assurance and current scope section before connecting regulated or contractually restricted material.

Access control

Visibility is enforced at the transport, before the request is interpreted. A private server checks authorisation before it reads which JSON-RPC method was called, so an unauthenticated caller is refused initialize and tools/list alongside tools/call. A list of tool names describes what a server indexed, so refusing the search while answering the introduction would not be a refusal.

A request for a server owned by another account is answered as not found, rather than as a permission error. Existence is not confirmed to a caller who is not entitled to it.

Access tokens are scoped to one server. A token issued for one server cannot be used against another, including another server in the same account. Tokens are stored as SHA-256 hashes, the plaintext is displayed once at creation and is not recoverable afterwards, and each token is named and revoked individually.

Rate limits are applied per calling address, at 200 MCP requests per minute. The allowance covers every MCP request from that address rather than one per server.

Server visibility and private sources

A server is public or private, and you choose it when you create the server.

Connecting a private GitHub repository sets the server private and holds it there. The determination is made from GitHub's own answer about the repository, not from anything the browser sent, because a request that claimed a private repository was public would otherwise be enough to index it into an open server. The server cannot be returned to public while that source is attached.

A server with an uploaded file defaults to private. It is not locked, because only the person who chose the file knows whether it is confidential.

A source that carries an API credential sets the server private, and removing the credential does not unlock it. Otherwise deleting a key would become the way to publish content that only the key could read.

Credentials for connected sources

When you connect another MCP endpoint that requires authentication, the key has to be sent to that endpoint on each request, so it is stored reversibly rather than hashed.

• It is encrypted at rest with AES-256-GCM under a key held outside the database. The authentication tag covers the stored record, so an altered record fails rather than sending a corrupted key to your provider.
• The ciphertext is never returned by any API. The dashboard reads only whether a credential is present.
• The plaintext is never written to browser storage or to a saved draft.
• Only Authorization and X-API-Key are accepted as header names.
• If the encryption key is not configured, the feature is refused rather than storing a credential in plain text.
• Only retrieval tools on a connected endpoint are ever called. A tool whose job is to send, create, publish, or submit is never selected.

Uploaded files

Files are parsed on upload and the original bytes are discarded, with one exception. What is retained is the extracted text, which is what the index is built from.

Images are the exception, because an image can be returned to a client as an image. PNG, JPEG and WebP files are retained. SVG is not, since its text is read directly. The storage address of a retained image is never returned to a caller: the bytes are read server-side and included in a response the transport has already authorised, so an image cannot be reached by a URL that outlives the server's access rules.

Text written by a vision model is labelled as generated wherever it is shown, so a transcription is never presented as if it were the document's own words.

Outbound requests

Every source begins as a URL you supply, and the platform fetches it on your behalf.

• The destination address is resolved and checked before the request is made, and internal and link-local addresses are refused. Every address a hostname answers with is checked, not only the first.
• Redirects are followed one hop at a time and each new destination is checked the same way, because a public URL that redirects inward is the ordinary way an address filter is defeated.
• When a redirect crosses to a different host, Authorization and Cookie are dropped rather than forwarded, so a token issued for one service is never handed to another.

Authentication and account linking

Sign-in uses GitHub or Google OAuth and asks for identity only.

Accounts are never linked automatically by email address. A new provider is linked to the account that is already signed in, and never to an account that merely shares an email address.

Repository access is requested at the point it is needed. The GitHub sign-in scope covers reading your profile and email. The broader repository scope is requested when you paste a private repository URL, not when you create an account. GitHub OAuth Apps do not offer a read-only or per-repository variant of that scope, so granting it grants more than MCP Studio uses. If that is outside your policy, connect public repositories or upload the files instead.

Deletion

Disconnecting a source removes its content, not only the reference. The indexed pages go, and so do two stores that hold real text rather than a pointer to it: cached search results, and the passage excerpts kept for the analytics dashboard. Retained image bytes are released as well. The cleanup runs before the source record is removed, so a partial failure leaves the source visible rather than reporting a clean removal over content that is still readable.

Requesting account deletion stops every one of your servers immediately. The endpoints refuse on the next request rather than at the end of a grace period. The account record is removed afterwards, and any live subscription is cancelled as part of the same request.

Deletion is irreversible and there is no cancellation path.

Retention

What is retained	For how long
Question text and returned passage excerpts, free tier	90 days
Question text and returned passage excerpts, paid analytics	395 days
Request records: timestamp, duration, tool, outcome	395 days
Cached search results	5 minutes
Indexed content and retained images	Until the source is disconnected or the account is deleted

On the free tier the question text and excerpts are removed at 90 days while the timing and usage figures remain to day 395, so usage history survives without the text sitting there for a year.

Uploads are also subject to account-wide ceilings, documented in Uploading files.

Assurance and current scope

These are the answers to the questions a security review usually asks next.

No independent security assessment has been completed. MCP Studio has no third-party penetration test, SOC 2 report, or ISO 27001 certification.

Sessions expire on a schedule and signing out clears the current device. Central revocation of a session that has already been issued is not available.

Access decisions are recorded, and the record is not independently tamper-evident. There is no automated alerting on it.

Data deletion is available today through the account settings, and it is described above. A data processing agreement, a record of processing activities, and a documented subject access request process are available on request rather than published here.

The list of infrastructure and model providers is available on request.

We are not publishing target dates for the items above, because a date we published and missed would be worse than the plain statement of where things stand.

Deciding against your own policy

Use a public server for content that is already published. Documentation, public repositories, and marketing material have nothing to protect.

Use a private server with one token per client for anything internal. Name each token for where it is used, so revoking one is a decision rather than an investigation.

Keep the two kinds of server apart. Mixing published documentation with internal notes on one endpoint means the whole endpoint inherits the stricter requirement.

Review the client as well as the server. Retrieved passages pass through whichever AI tool made the request, and that tool has its own data handling.

If your policy requires independent certification, completed processing documentation, centrally revocable sessions, or per-repository source control permissions, MCP Studio does not meet it today. Connect public content, or wait for those items.

Reporting a vulnerability

Email zair@appatools.com with enough detail to reproduce the issue. We will confirm receipt and tell you what we find. Please do not test against another account's servers.