Toucan AI Docs
CoreGovernSecurity model

MCP access and security

How the Maker MCP and the Explorer MCP authenticate, what each credential can do, how long it lasts and how to revoke it.

Target audience: admins and security reviewers evaluating Toucan AI's MCP servers.

TL;DR

Toucan AI has two MCP servers. They do not share a credential: the Maker MCP acts as a signed-in maker through OAuth, and the Explorer MCP acts as an end user through a short-lived embed token. Both go through your row-level and column-level security.

The two servers

Maker MCPExplorer MCP
CredentialOAuth access token, obtained by the agent after you approve it in your browserEmbed token (encrypted, one hour by default), minted by your backend
Acts asThe maker or admin who approved itThe end user named in the token
ScopeOne user in one organization, fixed at approvalOne organization, with the token's attributes
Who may obtain itMakers and admins. An explorer account is refused.Anyone your backend mints a token for
Can change data or settingsYes: domains, access policies, data appsNo: it exposes one tool, which answers questions

Maker MCP

  • Authentication. The agent discovers the sign-in on its own, sends you to your browser, and shows a consent screen naming the agent and the organization. Toucan never gives the agent your password.
  • Static headers are not accepted. Embed tokens and browser sessions are refused: the server accepts only an access token the agent obtained for itself.
  • Role. Only makers and admins can approve. The tools can simulate any end user's attributes, which an explorer must not be able to do.
  • Revocation. Selecting Remove access under Connected applications (account settings, Security tab) deletes the approval. It takes effect on the next request, even if the agent holds a refresh token.
  • Upload tokens. To upload data app files over HTTP, an agent gets a token that is valid for 10 minutes and can write only to one data app's draft. Removing access does not cancel a token that was already issued: it stays usable until it expires.
  • Safeguards live in the tools. A change to access policies applies only if it was previewed first, by the same maker, for the same table and change, within 30 minutes. Domain changes can only add, never delete. A prompt cannot bypass these.
  • Audit. Every change an agent makes is logged against the account that approved it.

See Build with an AI agent.

Explorer MCP

  • Authentication. Your backend mints an embed token with the user's attributes, then connects to the server with it. The token expires after one hour, and no long-lived key is accepted. See Token security.
  • Isolation. Every query the assistant runs is scoped to the token's attributes. Conversation threads are prefixed with the organization, so one organization cannot resume another's.
  • Credits. Each question consumes AI credits like any other question to the assistant. See Credits and usage.

See Integrate Toucan into your own AI chat.

Questions to ask before you connect

  • Who can approve an agent in my organization? Makers and admins. Check roles and permissions.
  • What can a connected agent see? What its human can see, and anything it simulates for a user through attributes.
  • Where does my data go? To the AI model your agent uses, under that provider's terms: your agent is a separate service from Toucan.

API security

Previous Page

Data storage & retention

Next Page

On this page

TL;DRThe two serversMaker MCPExplorer MCPQuestions to ask before you connect