Ondes PRO MCP server

Ondes PRO MCP server security

Plugging an AI into the system that holds your orders, invoices and customers is a security decision before it is a convenience. This page explains plainly how the Ondes PRO MCP server authenticates an assistant (OAuth 2.1 or an API key), what a connection is allowed to do, how to cut it off, and what the AI can never get.

The Ondes PRO teamUpdated on 21 October 2026

Is MCP secure? The context, without the hype

The protocol grew fast, and some early implementations had serious flaws. In July 2025 a critical vulnerability was disclosed in mcp-remote, a small tool that bridges a remote server to a local client (CVE-2025-6514): a malicious server could get commands executed on the user’s machine during authorisation. On 20 May 2026 the NSA published an advisory on MCP security, pointing in particular to weak access controls, token lifecycle gaps and limited audit logging.

Neither means the protocol is unsafe by nature. Both are reminders that MCP security is decided in three places: how the client is authorised, what the server agrees to execute, and what the organisation can control afterwards. That is the order we follow here.

How the assistant authenticates: OAuth 2.1 with PKCE

OAuth 2.1 is the default path. Your Ondes PRO workspace is both the authorisation server and the resource server: the identity checked is a user of your instance, against your database, with no third party in the loop.

PKCE with S256 is mandatory and the plain method is rejected: it would send the proof down the same channel as the authorisation code, proving nothing.
No client secret. MCP clients are apps installed on a workstation; a secret stored there would be readable by anyone with the machine. PKCE is what proves the client redeeming the code is the one that asked for it.
Exact redirect URI matching, with only a loopback port allowed to vary (as RFC 8252 permits): plain prefix matching would let a look-alike domain through.
No error is sent back to an unverified client: until the client and redirect URI pair checks out, the refusal is shown inside your workspace, never as a redirect.
A consent screen that spells it out: it states what the connection will be able to do and highlights the callback host, rather than whatever name the app gave itself at dynamic registration.
One-hour access tokens, signed, refreshed by the client for as long as the connection lives.
Audience check (resource, RFC 8707): a token issued for one workspace is worthless on any other Ondes PRO workspace.

Ondes PRO consent screen (in French): destination, callback address, name declared by the application, account, and a warning about the connection’s full permissions. — The actual consent screen (shown in French): it displays the callback address, flags that the application name is self-declared and unverified, and states the connection’s full permissions.

Revoking an MCP connection: instant, one machine at a time

Every connection is listed in the MCP tab of the “API & Developers” area under a name a human understands — “Cursor, on my laptop” — with its creation date, last activity and last IP address. A lost laptop or a departing employee is handled in one click, without touching any other device.

Revocation does not wait for the token to expire. The access token only points to a connection, which is re-checked on every call: once the connection is cut, the token becomes useless on the spot. Refresh tokens are stored as hashes, never in clear text.

List of active MCP connections (in French): Claude Desktop, Claude Code on a MacBook, Cursor on a workshop computer, each with its date, last activity, IP address and a Revoke button. — Active connections, in the MCP tab of API & Developers: one row per machine, with its last activity and IP address.

Limiting what an AI can reach: scoped API keys

When a full identity is too much — a contractor, a dashboard, an agent that should only read — use an API key instead of OAuth (header Authorization: ApiKey opk_…). Keys are created under API & Developers → API keys and carry module:action scopes, read-only invoicing for instance.

A scope is a ceiling, never a grant: access requires the scope and the holder’s matching permission. A key therefore never outranks the person who created it, and some resources (roles, encrypted messaging) stay closed to keys by design. Each key has its own adjustable per-minute quota and can be suspended without being destroyed. Connecting to the MCP server also requires the “API & Developers” module in your role.

OAuth or API key: which one for which job?

Criterion	OAuth connection	API key
Permissions	The person’s full identity	Chosen scopes, capped by the holder
Lifetime	One-hour token, refreshed	Until revoked or suspended
Revocation	Per machine, instant	Per key, instant
Nothing to store client-side	Yes	No: the key is a secret to protect
Typical use	A developer or owner on their own machine	Narrow access, automation, third parties

When the AI is asked to do something risky

The server does not rely on the model being careful. Here an irreversible request is brought back to what the law and the API allow.

Claude · Example conversation · demo data (Atelier Lumen)

You : Invoice FAC-2026-0214 went to Maison Verdier by mistake. Delete it.
MCP tool : ondes_impossible An issued invoice cannot be deleted; the intended action is a credit note.
MCP tool : ondes_ressource Reads the billing/factures sheet: the avoir/ action expects a reason and a full or partial choice.
Assistant : An issued invoice can’t be deleted. I can issue a full credit note for €1,340 incl. VAT with the reason “Invoice sent in error”. Invoicing has no test mode, so the credit note will be real. Shall I issue it?
You : Yes.
MCP tool : ondes_appeler Credit note AV-2026-0014 issued, live mode stated in the response.

Write safeguards built into the MCP server

Letting an AI write does not mean letting it write any old way.

Test mode by default: when a resource has a test twin (store orders, meetings, email sends, invitations; mailboxes in dry-run), ondes_appeler writes there unless the assistant explicitly passes reel: true.
Dry run on any resource: simuler: true validates a request body without saving anything.
Automatic idempotency: a request replayed after a network drop never creates a duplicate.
Mode always stated: every response says whether it was a test or a real write.
Plan, then confirm: writes from the built-in assistant (ondes_assistant) are proposed as a plan and run only once you approve.
Readable refusals: a business-rule refusal comes back as a result the assistant understands and corrects, not as an outage that would tempt it to work around it.

What the AI cannot do, even with your permissions

Read the content of your end-to-end encrypted Drive: the server decrypts nothing. The assistant sees metadata; content only opens with an application key you approve yourself in your browser. See the Drive over MCP.
Obtain a secret: the API never returns passwords, tokens or private keys.
Send from an arbitrary address: mail goes out from your own domain’s mailboxes, not from an invented sender.
Delete an issued invoice: you issue a credit note, with a reason.
Discover what it would be refused: tools, table of contents, search and resource sheets are filtered by the user’s scope. The assistant is never shown what would answer 403.

Logging and audit trail for MCP calls

Every call made through ondes_appeler is written to the API request log, tagged “MCP”, with method, path, status and originating connection — including OAuth connections, which have no API key to attach it to. Documentation searches only keep their main term: never a request body.

The log serves audits (“who created this quote, and from which machine?”) as much as product work: a term searched often and never found points to a gap.

Isolation: one instance per customer, one boundary per company

Every Ondes PRO customer runs their own instance, in a dedicated container with a dedicated database, hosted in France. The MCP server lives inside that instance: there is no shared entry point through which a connection could slide into another customer’s data, and the audience check shuts out tokens from other workspaces.

Within a multi-company instance, ondes_appeler takes an espace parameter to target a subsidiary. It is re-checked against the user’s permissions on every call: a subsidiary never sees a sister company’s data, and a user restricted to one company cannot grant themselves the group view. For the rest of the platform, see Ondes PRO security.

Keep reading

Frequently asked questions

Is MCP secure?

The protocol provides a framework; security depends on the implementation. The Ondes PRO MCP server enforces OAuth 2.1 with PKCE S256, one-hour tokens bound to a single workspace, instant per-machine revocation, test mode by default for writes that support it, and logging of every call.

What can an AI connected through OAuth do?

Exactly what the person who authorised the connection can do, no more and no less. The consent screen says so. For narrower access, use an API key with limited scopes: it never exceeds its holder’s permissions.

How do I cut off an AI assistant’s access?

Open the MCP tab in the “API & Developers” area and revoke the connection, identified by its machine name. The cut is immediate: the current token becomes useless without waiting for its one-hour expiry.

Why is there no OAuth client secret?

MCP clients are apps installed on a workstation: a secret stored there would be readable by anyone with access to the machine, so it would protect nothing. Proof relies on PKCE with S256, and the plain method is rejected.

Can the AI read the files in my Drive?

No. The Ondes PRO Drive is end-to-end encrypted and the server decrypts nothing: an AI connected over MCP sees metadata, not content. Only an application key you approve in your browser can read files, as part of a developer integration.

Where is the data hosted?

In France, in a dedicated instance per customer (its own container and database). The MCP server is part of that instance; what the assistant reads then passes through the vendor of the assistant you chose, under its own terms.

Could an AI accidentally write to my live data?

Resources that have a test twin receive writes in test mode by default; a real write has to be requested explicitly, and every response states the mode used. Any write can also be dry-run without saving anything.

Plug your AI into your business

The MCP server is included in every plan, with no add-on or extra fee.

Create my workspace See pricing