Security and privacy
How Pilot MCP authenticates your assistant, keeps your ad platform access, limits what goes to a third-party model, and what it keeps.
Your assistant never gets your ad platform access: it gets a Pilot token, bound to one workspace, read-only, that you can remove at any time. Pilot adds the platform access itself, on each call, and only serves the accounts attached to the workspace.
Assistant connection
- OAuth 2.1 with PKCE. Your assistant registers with Pilot, sends you to the authorization screen, then receives a token. The authorization code lives one minute, the access token one hour, its refresh thirty days.
- One token per workspace. The token is bound to the workspace chosen at authorization. It cannot be used on any other workspace.
- Your role re-read on every call. Pilot re-reads your workspace membership and role on every call and every refresh. Someone removed from the workspace loses access on the next call.
- Access keys. For a tool that cannot sign in on its own, an admin creates an access key in the console. Pilot only keeps its fingerprint: the key is shown only once. It does not expire on its own; remove it as soon as it is no longer used. Its role never exceeds that of the person who created it.
Your ad platform access
- The access the platforms give Pilot is encrypted in its vault and added by Pilot on each call.
- No tool served to your assistant asks for or returns a token, a secret or a sign-in identifier: these parameters are removed from the announced schemas.
- Tools that return a secret, such as OAuth token tools or GA4 Measurement Protocol secrets, are never served. The full list is on Ad platforms and their tools.
What goes to your assistant
What your assistant receives is processed by its provider (Anthropic, OpenAI, Cursor or another) under its own terms. Pilot limits what goes out:
- Only your attached accounts, and only read-only.
- Never personal data of your customers: customer lists, form leads, user-level audience exports are never served.
- Never your emails or documents: personal connectors (Gmail, Drive, Outlook, OneDrive, Google Workspace, Microsoft 365) are never served by Pilot MCP.
- Bounded responses: an ad platform tool response longer than 100,000 characters is cut, with a notice at the start and the end that says so.
To stay in control, turn on tool call approval in your assistant, and beware of instructions hidden in content the assistant reads: that is prompt injection, the risk specific to assistants. Since Pilot MCP is read-only, such a hijack cannot change anything in your accounts.
Rate limits
| Access | Limit |
|---|---|
| OAuth token (Claude, ChatGPT, Cursor…) | 60 calls per minute |
| Access key | 20 calls per minute by default |
| OAuth client registration | 10 per minute per network address |
| OAuth token exchange | 60 per minute per network address |
Beyond that, Pilot answers 429; the assistant retries a little later. Discovery calls (connection, tool list) do not count.
What Pilot keeps
- The call log. Every tool call is recorded: the tool, its arguments without secrets, the result (success or failure), the duration, the application, the network address. Admins see it in the console, Recent activity block.
- Collected data. For the accounts your assistants query, Pilot collects every night the figures its analyses read.
- Purge. Every hour, Pilot deletes expired authorization codes, tokens revoked or whose refresh expired seven days ago, and OAuth clients never used for seven days.
Legal pages
Conversion tracking check
Checks that conversions are tracked as intended on each platform (Google Ads conversion actions, Meta pixels, GA4 key events and the GA4 link to Google Ads) and that the volumes roughly agree.
Limits and plans
What a Pilot MCP plan counts, what happens at the limit, and what Pilot collects for your analyses.