# Security & data handling

How the MCP server authenticates requests, isolates workspaces, audits writes, and handles your data.

## Transport and credentials

- One HTTPS endpoint, stateless: no session ID is issued, so every request carries its own credentials.
- Tokens are opaque and Archive-issued, validated in process — no JWT to decode, no introspection endpoint.
- A **bearer token** has write parity with `/api/v2`. An **OAuth 2.1** connection is per-person, and write access exists only if the person granted the write scope at consent.
- OAuth discovery follows [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728) and [RFC 8414](https://www.rfc-editor.org/rfc/rfc8414), with [RFC 7591](https://www.rfc-editor.org/rfc/rfc7591) Dynamic Client Registration and mandatory S256 PKCE.

## Uniform error responses

Every authentication failure returns the same message, whether the token is missing, malformed, revoked, or disabled. Workspace-authorization misses are likewise uniform — identical for an unknown UUID, a workspace you’re not a member of, and one outside your grant — so responses can’t be used to probe which credentials or workspaces exist.

## Workspace isolation

Every tool call resolves exactly one workspace and executes the same resolvers, validation, and workspace scoping as `/api/v2`. There is no second data path and no second permission model.

## Auditing

Every write emits exactly one structured audit event, whatever the outcome, carrying the principal identity, the auth strategy, the MCP client name, the result, and any `userErrors`.

## What a connected agent can read

Within its granted workspaces: captured content and media, engagement metrics, creator profiles including contact details, and saved views. Read tools return only the fields their schema declares; nothing outside the requested workspace is reachable, and the server does not read your conversation history, files, or memory.

Collection, use, retention, and third-party sharing are governed by the [Archive privacy policy](https://go.archive.ai/privacy-policy) and the [terms of service](https://go.archive.ai/terms-of-service).

## Report a vulnerability

Email <support@archive.com> with `SECURITY` in the subject line, a description of the issue, steps to reproduce, and the affected endpoint. We acknowledge reports within two business days. Please don’t test against workspaces you don’t own or access data that isn’t yours.

> **Rotate a leaked token immediately**
>
> Delete it in the Integration tab and create a new one. Revocation is immediate: the next call with the old token returns 401.