.. _2026-09-21-mcp-security-hardening_release:

=================================================================================
2026-09-21 - MCP Connection Security Hardened
=================================================================================

Release
==================
AgileData.io - Tighter MCP Security: Auth Logging and Strict Role Enforcement

Two security improvements were applied to the MCP server layer that handles AI agent and Copilot connections.

First, all MCP connection requests are now logged with the access token identity, providing a clear audit trail of which user or service account made each connection. Second, the role lookup for MCP users has been hardened: if a connecting user has no tenancy role assigned, they now receive a 401 Unauthorized response immediately, rather than having access silently fail later in the request lifecycle.

**What's New:**

* MCP connection requests logged with access token identity for audit purposes
* Users with no tenancy role receive 401 at connection time — strict fail-fast enforcement

**What this means for you:**

* Connection attempts to the MCP server are traceable by identity
* Unauthorised users are rejected immediately, reducing the risk of partial access
* Cleaner security posture for AI agent and Copilot integrations

Last Refreshed
===========================
*Doc Refreshed: 2026-09-21*