Security and Privacy
What the Supercheck MCP server protects, and what you stay in control ofEdit
You stay in control
- You approve each connection and choose the single project it can read.
- Read-only. There is no tool that writes, triggers runs, starts AI SRE work or consumes quota.
- Disconnect works immediately. Remove an app under Account, Connected apps.
- Your role applies on every call. Access is re-checked for each request, not only when you connect, so these take effect at once:
- you disconnect the app
- you are removed from the organization (if you are removed only from the project, you keep read-only access as a viewer while you remain in the organization)
- your account is banned (and the ban has not expired)
- your role can no longer view that kind of resource
Sign-in design
| Property | Value |
|---|---|
| Protocol | OAuth 2.1 with PKCE (S256) and resource indicators |
| Scope | mcp:read (plus offline_access for refresh) |
| Access token | 15 minutes, bound to this server's URL |
| Refresh token | 30 days, rotated on use |
| Client registration | Dynamic registration, or Client ID Metadata Documents. Operators can require metadata documents only |