Security & Access Control

This page describes the authentication, authorization, and data-handling model of the Orbb MCP server (https://mcp.orbb.com/mcp). It is written for IT, security, and procurement teams evaluating the connection.

Summary

• Authentication is OAuth 2.1 against Orbb's identity platform — no API keys, no shared secrets, no static credentials.
• Every request runs as a specific, authenticated Orbb user; the accessible organization is resolved server-side from that identity and cannot be chosen by the client.
• MCP access is disabled by default and must be explicitly enabled per organization.
• The tool surface is read-only — no tool writes or modifies data.

Authentication

The server implements the standard MCP authorization specification, built on OAuth 2.1:

• Identity provider. Sign-in is handled by Orbb's identity platform (Clerk) — the same system that authenticates users of the Orbb web app. Existing session security (SSO, MFA, password policy) applies unchanged.
• Standards-based discovery. The server publishes OAuth protected-resource metadata (/.well-known/oauth-protected-resource/mcp, RFC 9728) and authorization-server metadata (RFC 8414). Clients discover the authorization server automatically and register via dynamic client registration — there are no client secrets or API keys to issue, store, or leak.
• Scopes. Tokens carry only the profile, email, and public_metadata scopes — identity and organization membership. Requests missing a required scope are rejected with a standard insufficient_scope challenge.
• Per-request validation. Every request presents a bearer access token, which is validated on every call. The MCP client never sees the user's Orbb password; tokens are scoped, expiring credentials managed by the identity platform.

Authorization and tenant isolation

• Server-side organization resolution. The organization a request may access is read from the authenticated user's identity record, which is managed by Orbb. It is not a request parameter — a client cannot name, guess, or switch organizations.
• Organization-scoped queries. The resolved organization ID is threaded into every tool execution, and all data access is filtered by it at the data layer. A token structurally cannot return another tenant's data.
• Per-organization opt-in. MCP access is gated by an organization-level setting that is off by default. Until your organization explicitly enables it, every tool call is rejected — regardless of authentication. Your Orbb customer team can disable it again at any time, which immediately cuts off all connected clients.
• User attribution. Each call is attributed to the individual signed-in user, not a shared service identity.

Role-based access control

Members of an organization connect with their own Orbb account and access their organization's data. Every tool call runs with that individual user's identity — there are no shared service accounts, and no elevated capability is available through the MCP endpoint.

Data access and handling

• Read-only surface. Search, path-finding, and interaction tools only read data. No tool modifies your relationship graph, contacts, accounts, or CRM records, and nothing is written back to any connected system (CRM, email, calendar).
• No additional data store. The MCP server reads from the same production databases as the Orbb application, under the same controls. Connecting MCP does not copy your data anywhere new.
• Transport security. The endpoint is served exclusively over HTTPS (TLS), with standard security headers.

Auditability

Every tool invocation is logged in Orbb's production infrastructure with the calling user, organization, tool name, and outcome. Product analytics events exclude free-form request content.

Revoking access

Level	Action	Effect
Client	Remove the Orbb connector in the AI assistant	That client's access is discarded
User	Deactivate the user's Orbb account	All of that user's access, including MCP, is revoked
Organization	Ask your Orbb customer team to disable MCP	All MCP access for the organization stops immediately

Questions

For security questionnaires, data-processing details, or anything not covered here, contact your Orbb customer team.