2026-09-21 - MCP Connection Security Hardened¶
Release¶
AgileData.io - Tighter MCP Security: Auth Logging and Strict Role Enforcement
Two security improvements were applied to the MCP server layer that handles AI agent and Copilot connections.
First, all MCP connection requests are now logged with the access token identity, providing a clear audit trail of which user or service account made each connection. Second, the role lookup for MCP users has been hardened: if a connecting user has no tenancy role assigned, they now receive a 401 Unauthorized response immediately, rather than having access silently fail later in the request lifecycle.
What’s New:
MCP connection requests logged with access token identity for audit purposes
Users with no tenancy role receive 401 at connection time — strict fail-fast enforcement
What this means for you:
Connection attempts to the MCP server are traceable by identity
Unauthorised users are rejected immediately, reducing the risk of partial access
Cleaner security posture for AI agent and Copilot integrations
Last Refreshed¶
Doc Refreshed: 2026-09-21