Sign in
← MCP overview
MCP Server

MCP security & privacy

What the AudioScape MCP at mcp.audioscape.ai sees, what it stores, what it never logs, and how API keys flow.

Sign in

Sign-in goes through your existing Roblox account — the same one that gates the developer portal. We never see your Roblox password. After sign-in, you grant the MCP a set of scopes (read your catalog, send analytics, etc.) and approve. Your AI client holds the resulting access token in its credential store; the token never lives in a file you can accidentally commit.

Your account has one MCP key, shared across every AI client you sign in from (Claude Code, Cursor, etc.). Revoking it from your keys page pauses MCP access for all of them at once. Granting consent again from any client unpauses it — same key, just toggled back on.

How production keys reach your game

When you ask your AI to set up a production key, it calls provision_production_key. That tool returns a URL on this portal — not a key value.

You open the URL, sign in (if you weren't already), confirm the name, and click Create. The new key is revealed once on the page in your browser, and you copy it from there. The AI never sees the value, and the key never appears in your chat transcript.

From there, you add it as a Roblox Studio Secret (Game Settings → Security → Add Secret) so the scaffolded code can pick it up via HttpService:GetSecret in published builds.

What we see

  • Tool call arguments — when you ask “search for lo-fi music”, we see the search query as a tool argument.
  • Tool call return values — search results, taxonomy data, beat grids. Same shape the API returns to a Roblox game server.

What we never see

  • Your game source code. Your AI client reads files locally; the MCP only sees what your AI explicitly passes as a tool argument.
  • Production API key values. Keys created via provision_production_key are minted on the portal in your browser and never touch the MCP.
  • Anything outside the AudioScape catalog. The MCP has no “read file” or “run command” tools. It's scoped to catalog access and Luau code generation.

What we store, and for how long

  • Per-call request logs (timestamp, tool name, status, latency) — same retention as the rest of your developer API usage, 90 days.
  • Your portal user record — the same one created when you first signed into the developer portal.

Verify it for yourself

Every call your MCP makes appears in real time on your MCP activity dashboard — tool name, parameters, status, and latency. If the AI did something on your behalf, you can see exactly what.

Open MCP activity

Contact

Security questions or vulnerability reports: security@audioscape.ai.