Data & credentials
Understand access control boundaries, credential isolation policies, and incident mitigation procedures.
Manage access
Members access content through their identities. MCP lets an authorized client act for you across current and future workspaces. It does not bypass current membership.
Manage MCP grants, X and GitHub connections separately in personal settings. Revoking one type does not revoke the others. Leaving a team does not delete your content in other workspaces.
Suspected exposure
Revoke the affected MCP authorization or platform connection and review recent activity. For X or GitHub, also check authorization on the platform. Keep passwords, tokens and cookies out of prompts, documents and public logs.
MCP audit records contain caller identity, tool, resource, outcome and duration, retained for 90 days by default. Tokens and full content are excluded. Consult the site's privacy policy or support for further data handling questions.