Skip to main content
Who this is for: Brand administrators evaluating MCP, and integrators wiring MCP clients. End users mostly just complete the Keystone app consent screen.
Keystone MCP uses OAuth 2.1 with PKCE (the standard for remote MCP servers). Your AI client never stores your Keystone password. The AI client opens Keystone’s authorization URL; Keystone redirects you into the Keystone app so you sign in with the normal stack (email/password, SSO, MFA when enabled), then consent. After you allow access, the app mints an authorization code for the AI client.

​
Who can connect

​
Scope

Connections receive a single scope:

​
What the AI can see

Every tool call runs as you:
  • Postgres Row Level Security (tenant, role, partner assignment) applies the same way as in the Keystone app and Gus.
  • Reps only see their assigned accounts; brand users see brand-wide data according to their role.
  • Keystone does not give the AI a service-role or admin key.

​
Managing sessions

  • Open Settings → MCP connections to list active AI clients and Revoke any of them.
  • AI clients that support RFC 7009 can also call the MCP revocation endpoint.
  • Turn off Enable MCP (AI clients) in Platform Settings, or drop to Basic, to stop MCP data access for the brand — new logins are blocked and existing sessions fail on the next data tool call.

​
Privacy note

Tool results leave Keystone and are processed by the AI vendor you chose (Anthropic, OpenAI, etc.). Use the same judgment you would when pasting Keystone data into that product’s chat window.