Skip to main content

MCP server safety and privacy

MessageGears customers trust us with subscriber data, and connecting an AI assistant to that data raises reasonable questions. This page describes the protections built into the MessageGears MCP server and the controls you keep.

The short version

The assistant acts only within your account, as you, scoped to your permissions. It never sees your credentials. Destructive actions always require your explicit confirmation. The tool set is bounded: the assistant can only do what the server exposes.

Trust model​

Scoped access, as you​

Every action runs as your MessageGears user, inheriting exactly your roles and brand access. Results are filtered to that scope by the MessageGears platform itself, not by the assistant deciding what to show you, so the assistant cannot reach data you couldn't reach in the UI, and cannot reach another customer's data at all.

You authenticate once in your browser (see Set up the MessageGears MCP server). There is no API key for you to hold, and no credential is ever placed in your client configuration or in the conversation. See Security controls in depth for how credentials and tokens are handled.

A bounded set of tools​

The assistant cannot run arbitrary code or arbitrary API calls against your account. It can only invoke the specific tools the server publishes (see MCP server capabilities). Anything outside that set is unreachable.

Confirmation gates on risky actions​

Any destructive or irreversible action requires the assistant to stop and ask you to confirm first. Today that means deleting a template or an external campaign: the assistant summarizes exactly what is about to be removed and waits for your explicit "yes."

Production sends sit behind a stronger control than a confirmation: the assistant cannot launch a marketing campaign send at all. It prepares the campaign and runs the readiness checklist; the launch itself happens in Accelerator, by a person, under Accelerator's own controls.

Read versus write clarity​

Tools are either read-only (listing, inspecting, checking status) or create/modify/act. The assistant tells you which kind of action it is taking. When in doubt, ask it to "just show me, don't change anything."

Capability gating by version and plan​

The server only enables tools your account supports. If you ask for an unsupported capability, the assistant reports that rather than attempting it.

Security controls in depth​

For security teams evaluating the MCP server, these are the controls as implemented.

Authentication and tokens​

  • Sign-in uses OAuth 2.1 with PKCE, and only the S256 challenge method is accepted; weaker methods are rejected outright.
  • Authorization codes are single-use and short-lived, and are bound to the client and redirect that requested them.
  • Access tokens are short-lived and paired with rotating refresh tokens. Refresh tokens are stored only as SHA-256 hashes, so a copy of the server's database does not yield usable tokens.
  • Your password is entered only on the MessageGears sign-in page in your browser. It never appears in the conversation, in tool arguments, or in your client configuration.

Credential storage and handling​

  • Platform credentials the server holds are encrypted at rest with AES-256-GCM, using a unique nonce per value and an authenticated, versioned format.
  • Credentials are decrypted only in memory to make a platform call. No tool response contains a credential; where a status view must reference one, it is masked.

What reaches the AI model​

The assistant sees what the tools return: configuration, aggregate counts, status, links into Accelerator, and content you author in the conversation. No tool returns subscriber rows or warehouse result sets, so bulk customer data cannot flow to the model through the tool surface.

Send safety, enforced server-side​

The guardrails around sending are implemented in the server, not left to the assistant's judgment:

  • The assistant cannot trigger a production send. No tool launches, schedules, or deletes a marketing campaign; those actions live in Accelerator, behind its own permissions and audit trail.
  • Test audiences are hard-routed: every recipient in a test audience resolves to the account's configured test inbox, enforced server-side, so a test cannot accidentally reach real subscribers.
  • The pre-send launch checklist is available conversationally, so readiness is checked before anyone opens the launch screen.

Network posture​

The server talks to a fixed, configured MessageGears endpoint. Neither you nor the assistant can redirect it to another host, so a misbehaving or manipulated prompt cannot turn the server into a proxy for arbitrary destinations.

Personal and subscriber data​

The tool set works with configuration, aggregates, and status: audience definitions and row counts, campaign setup, template content, and job state. No tool returns recipient rows or looks up an individual subscriber's data.

  • An audience's SQL definition can still reference personal data fields, and content you draft may quote customer information you paste in. Treat the conversation accordingly; your AI client's retention and privacy settings apply to it.
  • Prefer aggregate views (row counts, campaign status) for everyday work, and keep subscriber data out of prompts unless you need it there.

Where does my data go?​

  1. Your prompt goes from your MCP client to your AI provider (for example, Anthropic for Claude). That exchange is governed by the provider's terms.
  2. When the assistant calls a MessageGears tool, the request goes to the MessageGears MCP server, which calls the MessageGears platform using the credential it holds for your signed-in user.
  3. Results return to the assistant, which summarizes them for you.

Two parties are involved, your AI provider and MessageGears, and both privacy policies apply. For MessageGears' data handling commitments, contact your account team or refer to MessageGears' security and compliance resources.

Your controls​

  • Sign out of the MessageGears MCP server in your client to cut off its access.
  • Change your MessageGears password to invalidate the sign-in the server relied on.
  • Confirmation discipline: never approve a delete you didn't intend; read the assistant's summary of what is being removed.
  • Review before launch: run the pre-launch checklist, and try a test audience that routes to your inbox before any real launch from Accelerator.

Responsible use​

The MCP server is a productivity tool, not an autopilot. You remain responsible for:

  • The content you send and its compliance with applicable law and consent requirements (for example CAN-SPAM, GDPR, and CASL).
  • Who you send to.
  • Reviewing assistant output. Verify before you send.