> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goautofire.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP security

> Understand AutoFire MCP isolation, permissions, rate limits, logging, and incident response.

## Tenant isolation

The authenticated credential resolves to exactly one dealership. Database functions require that dealership ID internally, and every query filters on it. The client cannot choose or override tenant context.

## Least privilege

Tools are registered only when their required permission is present. Full lead contact data requires the separate `leads:pii` permission in addition to `leads:read`. Create different keys for different clients.

## Credential protection

* Keys contain 256 bits of generated randomness.
* Only an HMAC verifier and identifying prefix are stored after creation.
* Keys expire in 30, 60, or 90 days and can be revoked immediately.
* A dealership can have no more than five active keys.

## Request controls

AutoFire validates the host and browser origin, caps request bodies at 128 KiB, disables response caching, validates every tool argument and output, and rate-limits by source, key, dealership, and tool. Limits vary by sensitivity; full lead lookup is more restrictive than vehicle lookup.

## Audit metadata

Successful and denied tool calls record limited operational metadata: key ID, dealership ID, tool, outcome, timing, result count, and a one-way hash of the source network address. API keys, tool arguments, and returned customer content are excluded from this ledger. The normal retention target is 90 days.

## If a key is exposed

1. Revoke it from **Dashboard → MCP & API**.
2. Remove it from the affected client and secret stores.
3. Create a replacement with the minimum permissions.
4. Contact AutoFire support if you need help reviewing activity.

Revocation prevents future AutoFire access; it cannot erase data already sent to a connected provider.