> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rocketblue.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP security

> Technical and security details of the rocketblue MCP server for IT and procurement review.

## Purpose of this page

This page is for security, IT, and procurement teams reviewing rocketblue MCP before connecting it to an AI client (Claude, ChatGPT, Cursor, or another MCP-compatible assistant).

For platform-wide controls, data residency, subprocessors, and certifications, see the [Security Overview](https://app.rocketblue.ai/security-overview.html) (customer-shareable; Print → Save as PDF).

## What MCP is in rocketblue

rocketblue exposes a remote [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server. It is **not** a local process, browser extension, or inbound connection into your network. Your AI client calls our HTTPS endpoint; we never initiate connections into your environment.

MCP is a thin protocol layer over the same **organization API** used by REST integrations. Authentication, tenancy, rate limits, and data access are identical whether a client calls REST or MCP tools.

| Item          | Value                                                                           |
| ------------- | ------------------------------------------------------------------------------- |
| **Endpoint**  | `https://app.rocketblue.ai/api/mcp` (unique per-team URL in **Settings → MCP**) |
| **Transport** | Streamable HTTP (JSON-RPC over HTTPS)                                           |
| **Protocol**  | MCP `2024-11-05`                                                                |
| **Hosting**   | Supabase Edge Functions on AWS **eu-central-1 (Frankfurt)**                     |
| **TLS**       | Required end-to-end                                                             |

Discovery metadata:

* Protected resource: `https://app.rocketblue.ai/api/mcp/.well-known/oauth-protected-resource`
* Authorization server: `https://app.rocketblue.ai/api/mcp/oauth/.well-known/oauth-authorization-server`

## What data MCP can access

A connected client can only see **that organization's rocketblue workspace**: brands, prompts/topics, analysis runs, visibility results, cited sources, perception scores, content drafts, and related settings.

MCP does **not** grant access to:

* Other rocketblue customers (hard organization boundary)
* Your internal systems, files, CRMs, or employee directories
* Payment card data (Stripe only; never stored by rocketblue)
* Optional GA4 / Search Console / Cloudflare datasets (those are fetched live in the product UI and are not MCP tools)

rocketblue's core dataset is public AI answers collected on the customer's behalf, plus the configuration the customer entered. See [Security Overview §2](https://app.rocketblue.ai/security-overview.html).

## Authentication

Two methods, both organization-scoped:

### OAuth 2.0 (recommended for Claude and ChatGPT)

| Property                        | Detail                                                                                            |
| ------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Flow**                        | Authorization code with **PKCE (S256)**                                                           |
| **Grants**                      | `authorization_code`, `refresh_token`                                                             |
| **Scope**                       | `spotlight:mcp`                                                                                   |
| **Client type**                 | Confidential; Client ID and Secret issued per organization in **Settings → MCP**                  |
| **Dynamic client registration** | **Not supported** (registration endpoint returns `501`). Use the pre-issued Client ID and Secret. |
| **User consent**                | Interactive approve/deny on `app.rocketblue.ai` while signed in                                   |
| **Who can authorize**           | Organization members who are not **viewer** or **guest**                                          |
| **Access token**                | Signed JWT (HS256), **1 hour** TTL, audience bound to the MCP resource                            |
| **Refresh token**               | **30 days**, SHA-256 hashed at rest, **rotated on every use**                                     |
| **Authorization codes**         | Single-use, **10 minutes**                                                                        |

Token endpoint authenticates the client with `client_secret_post` or `client_secret_basic`. Redirect URIs must be `https` (or localhost for development). Vendor callbacks on `*.openai.com`, `*.anthropic.com`, `*.claude.ai`, `*.cursor.com`, and `*.cursor.sh` are allowed.

Rotating the Client Secret in Settings immediately invalidates the previous secret. Refresh is also rejected if the authorizing user is no longer a member, or has been changed to viewer/guest.

### API key (Cursor and header-based clients)

Organization API keys from **Settings → API** may be sent as `x-api-key`, `x-spotlight-api-key`, `spotlight-api-key`, or `Authorization: Bearer`. Keys are scoped to one organization and can be rotated in Settings. Viewers and guests cannot manage keys.

Unauthenticated MCP calls receive `401` with RFC 6750 `WWW-Authenticate` pointing at protected-resource metadata, so compatible clients can start OAuth discovery.

## Authorization and tenancy

* Every credential maps to **one organization**. Tools cannot select another org.
* Application tables use PostgreSQL **Row Level Security**. MCP executes through the same organization API as REST.
* **Viewer** and **guest** roles are read-only in the product and **cannot authorize MCP** or obtain tokens.
* Write tools (create/update/delete prompts, update content settings) use the same permission model as the REST API.

## Rate limiting and logging

* Default quota: **120 requests per minute** per organization (configurable). Shared with the REST API. Exceeding it returns `429` with `Retry-After`.
* Each MCP call is recorded in an organization request log: channel (`mcp`), HTTP method, JSON-RPC method, and tool name. Request bodies and secrets are not written to that log.

## Network and client requirements

* Outbound HTTPS from the AI client to `app.rocketblue.ai` (and the same path on `app.get-spotlight.com` if you use that domain).
* No inbound firewall changes, agents, or on-prem components.
* No IP allowlist is required. Authentication is credential-based, not network-based.
* CORS is enabled so browser-based MCP clients can call the endpoint; all data access still requires a valid token or API key.

## Compatible clients

| Client                                        | Typical auth                 | Notes                                                                                                                  |
| --------------------------------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Claude** (custom connector)                 | OAuth, your Client ID/Secret | See [Connect](/rocketblue-mcp/connect#claude)                                                                          |
| **ChatGPT** (custom MCP app / Developer mode) | OAuth, your Client ID/Secret | See [Connect](/rocketblue-mcp/connect#chatgpt). Availability depends on the ChatGPT plan and workspace admin settings. |
| **Cursor**                                    | API key header               | See [Connect](/rocketblue-mcp/connect#cursor)                                                                          |
| Other HTTP MCP clients                        | OAuth or API key             | Same Server URL                                                                                                        |

## Operational security (summary)

* HTTPS only; data at rest in **EU (Frankfurt)**.
* Service-role credentials stay on the server; they are never shipped to MCP clients.
* Client secrets can be rotated in-product. Refresh tokens are hashed and rotated.
* rocketblue does not currently hold its own ISO 27001 or SOC 2 report. Infrastructure providers (Supabase, AWS, Netlify, Stripe) do. Details: [Security Overview](https://app.rocketblue.ai/security-overview.html).

## Related pages

* [MCP overview](/mcp-overview)
* [Connect an MCP client](/rocketblue-mcp/connect)
* [MCP tools reference](/rocketblue-mcp/tools)
* [API authentication](/authentication)
* [Security Overview](https://app.rocketblue.ai/security-overview.html)
* Privacy Policy: [rocketblue.ai/privacy-policy](https://www.rocketblue.ai/privacy-policy/)

Security questionnaires: [privacy@rocketblue.ai](mailto:privacy@rocketblue.ai)