Security and data

Sign-inCopy Anchor Link

The server uses OAuth 2.1 with PKCE. There are no API keys and no static tokens.

1. Your app sends a request without a token and gets a 401 with a WWW-Authenticate header pointing at the server's protected resource metadata at https://mcp.supercurve.ai/.well-known/oauth-protected-resource/mcp.
2. That document names the authorization server. Clients register themselves there through dynamic client registration; no manual client setup is needed.
3. Your browser opens the Supercurve consent page. It shows the name of the app asking and the address it will return to. You sign in with your Supercurve account if you are not already, and choose Allow or Cancel.
4. The app receives an access token and a refresh token. The scopes are openid, email and profile, plus offline_access for the refresh token. Supercurve has no finer-grained scopes: a token acts with your permissions, no more and no less.

For hosted Claude, the return address is https://claude.ai/api/mcp/auth_callback. Command-line clients such as Claude Code and Codex use a loopback address on your own machine; the consent page shows it so you can check it is yours.

What a connected app can reachCopy Anchor Link

A connection acts as you. It sees the websites you can see and can take the actions you can take: members see the websites they were granted, admins see all of the organization's websites. The same row-level security that protects the product applies to every tool call.

Reading is the default. The actions available are the handful listed on the tools page: track a prompt, add a competitor, set content pillars, refresh a surface, change a check cadence, ask Curve to write. Nothing is published from a chat. Every post and every page change still waits for your approval in the Inbox.

Billing, membership and other account settings are not reachable over MCP.

Tokens and stopping an appCopy Anchor Link

Access tokens expire within an hour and are refreshed by the app on its own. To stop an app, remove the connector in that app; its access ends when the current token expires, within an hour. If you need a connection cut off immediately, write to hello@supercurve.ai.

What Supercurve keepsCopy Anchor Link

For every tool call the server records who called, through which app, which tool, the outcome and how long it took, for 90 days. It never stores the tool's arguments, your questions, Curve's answers or any text you typed. Per app it also keeps when you first and last used it.

Two tools leave something you can see in the product on purpose: ask_curve saves the thread as a normal Curve conversation, and create_draft puts the draft in the Inbox.

Tool results are sent to the AI app you connected and are handled under that app's own terms from there. How Supercurve handles personal data is described in the privacy policy; the security page covers hosting and practices.

Reporting a security issueCopy Anchor Link

Email security@supercurve.ai. Please do not open a public issue.