Security and audit

What the assistant can reach

  • The MCP server only exposes the tools on the Tools reference. There is no general database or file access.
  • Signed-in people get their own CMS visibility. Managers and group editors are fenced to their groups on every read and write tool, and can never target "everyone".
  • Tokens act as the admin who created them and see the whole company, limited by scope. Prefer the sign-in flow for people, and tokens for automations.
  • Survey results never include respondent names. Anonymous surveys apply the respondent threshold. Whistleblower forms and their responses are never returned. Hidden form responses are left out.
  • Phone numbers are omitted when the company hides phone numbers in the app.

Nothing publishes on its own

Created content is a draft. Only assignments and additions to already published content are live, and the assistant is instructed to confirm those with the person first. See Working with an assistant.

Logging

Every tool call and resource read is logged with:

  • who made it (person or token) and which client (Claude, ChatGPT, Gemini, Claude Code, Cursor and so on),
  • the tool name and its arguments (cut at 10,000 characters),
  • the outcome: success or the error message, and response time,
  • IP address and user agent.

Rejected requests are logged too. Logs are kept for 90 days. Monotree uses them to monitor the beta and to help with support questions.

Calls made through call_open_api also appear in the Open API request log, attributed to a short-lived token named "MCP fallback".

Managing connections

  • CMS → Open API → AI Connectors lists every signed-in connection for the company: person, client, connected date and expiry. Admins can disconnect any of them; the client loses access at once.
  • People can also remove the connector in their AI client.
  • Token access is managed under API Tokens: revoke, rotate or delete like any other token.
  • Connections that are unused for 90 days expire and are cleaned up automatically.

Transport

  • HTTPS only. The server is https://customer.monotree.com/mcp.
  • OAuth 2.1 with PKCE. Access tokens last 12 hours; refresh tokens 90 days.
  • 60 requests per minute per person or token. Over the limit, the server returns 429.
  • The feature is off by default and enabled per company by Monotree.

Reporting a concern

Email your Monotree contact or use the feedback endpoint. Security reports are handled with priority.