Data, Privacy, and Security

• Scoped to your permissions. MCP tools use your authenticated Attentive credentials. They do not grant access beyond your existing permissions.
• Limited to MCP tool activity. Attentive receives the tool calls, tool inputs, and tool results needed to fulfill the request. Attentive does not receive the full AI conversation transcript unless your client includes that content in tool inputs.
• No data beyond the Attentive UI. The current beta does not expose data that you could not already retrieve in the product.
• Read-only by default. Write actions are off unless you explicitly enable them with ?readOnly=false.
• Sensitive subscriber data. list_segment_subscribers can return subscriber phone numbers, email addresses, names, and signup dates. It is hidden from default read-only sessions and requires a write-enabled connection and confirmation. Results are returned to your chosen MCP client and may be processed or retained by that client's AI provider depending on their policies.
• External AI providers. Tool inputs and results are returned to your chosen MCP client and may be processed or retained by that client's AI provider. Review that provider's security, privacy, and retention policies before using personal or sensitive data.
• Human-in-the-loop. Attentive strongly recommends human review/approval for all write actions via the MCP.
• No credentials in config. Authentication uses OAuth through Attentive login. You never store an Attentive password or API key in your MCP configuration.

Note: Attentive logs operational security and diagnostic information for MCP usage, including authentication and session lifecycle events, optional client-provided request summaries, write-tool metadata, and failures with error context. Normal successful tool outputs are not written to application logs by the tool registry, though MCP protocol messages may be temporarily retained to support session operation and connection recovery.