Who This Article Is For
This article is written for the person who has to approve connecting an AI assistant to StockIQ — an IT manager, a security reviewer, or an administrator answering an internal questionnaire. It describes what the StockIQ MCP server exposes, how a connection is authenticated and authorised, where data travels, and what StockIQ records.
You do not need a connection or a token to read it. If you are instead ready to connect a client, see MCP Service — Getting Started. For the full list of tools, see MCP Service — Tool Reference.
What the MCP Server Is
The Model Context Protocol (MCP) is an open standard that lets an AI assistant call tools in another system. The StockIQ MCP server publishes StockIQ's own tools — forecasts, inventory positions, order suggestions, purchase history, executive summaries and a limited set of planning settings — so that an assistant your people already use can answer questions from your live StockIQ data.
It is an optional, licensed add-on. If your licence does not include it, the endpoint refuses every request and no token can be created. Nothing needs to be switched off to keep it unused; it is off until you buy it and an administrator issues a token.
Where Your Data Goes
This is the first question most security teams ask, so it is worth stating plainly and up front.
When an assistant calls a StockIQ tool, StockIQ returns the result to your AI client — Claude Code, Cursor, Codex, Continue or VS Code, running on your user's machine. That client then sends the result on to the AI provider it is configured to use, so the model can turn it into an answer.
StockIQ does not choose that provider, does not contract with it, and is not in the path between your client and it. The consequence is that the most important part of this boundary is under your control, not ours:
- You choose which provider sees the data, by choosing the client and the model it points at. If your organisation has an approved AI provider, a private deployment, or an enterprise agreement with zero-retention terms, use a client configured against it and those terms govern.
- You choose how much data can leave, through the token's roles and data scopes. A token scoped to one site cannot return another site's figures to any assistant, no matter how it is asked. Scoping the token is the effective control here — not instructing the assistant.
- Your provider's terms govern retention of anything the assistant sees, including tool results and the questions your users type. StockIQ's retention policy covers StockIQ's own records; it cannot cover your provider's.
NOTE: Edison, the assistant built into the StockIQ web application, is a different arrangement. There StockIQ runs the model under its own agreement, and no third party of your choosing is involved. If your policy does not permit StockIQ data to reach an external AI provider, Edison is the option that keeps it inside StockIQ — and it reaches the same tools.
Authentication
Access to the MCP endpoint is by MCP token only. A token is created inside StockIQ by an administrator holding the Administer MCP Tokens permission, and is presented by the client as an HTTP Authorization: Bearer header on every request.
| Property | Behaviour |
| Format | A signed JSON Web Token (JWT), verified on every request. |
| Storage at rest | StockIQ stores only a one-way hash. The token value is displayed once, when it is created, and cannot be retrieved afterwards — not by an administrator, and not by StockIQ Support. |
| Expiry | Set per token at creation. We recommend 90 days. Expiry is enforced at validation, so an expired token stops working immediately without any administrator action. |
| Rotation and revocation | Rotating issues a replacement and invalidates the previous value immediately. Deleting deactivates the token permanently. Both take effect on the client's next call — there is no cached-credential window. |
| Browser sessions | Cannot be used here. The MCP endpoint accepts only the MCP token scheme, so a signed-in user's browser session is not a credential for it and a browser cannot be induced to call it on a user's behalf. |
IMPORTANT: A token is a bearer credential. Anyone holding it can act with its roles and data scopes until it expires or is revoked. Issue one token per person per client, so that Last Used stays meaningful and a single revocation does not disrupt everyone. MCP Service — Getting Started covers safe storage.
Authorization
A token carries roles and, optionally, data scopes — sites, suppliers, buyers, shippers or item categories. These are the same roles and the same scoping mechanism used for StockIQ users, administered on the same screen.
Three points matter for a security review:
- The MCP server enforces the same gates as the web application, through the same code. External MCP calls and in-product Edison calls are dispatched by one component. There is not a second, looser path to the data that exists only for external clients.
- Most tools require a named permission. A token holding no roles authenticates successfully and finds almost nothing available. Access is granted deliberately, not inherited by connecting.
- Data scopes are applied to the request before the query runs, not by filtering results afterwards. The token's allowed sites, suppliers, buyers, shippers and categories are intersected into the request, so asking for a site outside the scope simply returns nothing for it — including in totals and aggregates. A request that names no site at all is treated as "every site this token is allowed", never as "every site".
Deliberate Limits on Tokens
A token is a program acting for your organisation, not a stand-in for a person. Several capabilities are therefore withheld from tokens regardless of which roles you grant. These are not configuration options; they are fixed in the product.
| Capability | Token | Why |
| Security administration | Denied | A token cannot create or read other tokens, and cannot change roles or permissions. This is what prevents a token from escalating its own access, and it is why a compromised token stays bounded by the scopes it was issued with. |
| Outbound email | Denied | A token cannot ask StockIQ to send mail to anyone, inside or outside your organisation. A long-lived credential that can send mail is an unattributed relay — nobody is accountable for the message. Mail StockIQ sends on its own schedule, such as report subscriptions and alerts, is unaffected. |
| Personal data | Denied | Saved views, preferences, recently-viewed items and personal notifications belong to a person. A token has no "mine", so it cannot read one user's personal context. |
| Writing shared AI memory | Denied | Organisation-wide remembered facts can be read but not added or removed. Those facts reach every colleague's conversations, so a person needs to approve the wording. |
| Business data | Allowed | Governed by the token's roles and data scopes — the same rules that apply to a user. |
| Order placement | Allowed if granted | Only if the token's roles allow it. Any order approval limits attached to those roles apply exactly as they would for a person. |
What a Connected Assistant Can Change
Most of what the MCP server offers is read-only. Of the tools published today, 15 can change data and the rest only retrieve it. The ones that change data cover placing purchase orders, reactivating inactive records, and a bounded set of planning settings — safety stock overrides, order policy overrides, replenishment and classing settings.
Three separate controls apply to those:
- Permission. Each write tool requires the same permission a user would need to make that change in the web application. A read-only role produces a read-only token.
- Confirmation. Several write tools run a two-step flow: the first call returns a preview naming exactly what would change, and the change is applied only on a second, explicitly confirmed call. This is what stops a misread instruction from becoming a silent bulk edit.
- Rate limiting. Writes are capped at 5 per minute per token, on top of the general request limits. A runaway client cannot make sweeping changes quickly.
NOTE: If you want a token that can never change anything, grant it read-only roles. That is the supported and auditable way to do it — more reliable than relying on instructions given to an assistant, which are guidance rather than enforcement.
Availability Controls
Two conditions cause the server to refuse work even for a valid, well-scoped token:
- Licence. If the MCP add-on is not on your licence, the endpoint refuses all requests.
- Scheduled data refresh. While your instance runs its scheduled processing, most tools are held back rather than allowed to report figures that are mid-recalculation. Clients receive a plain-language message and can retry when the refresh finishes.
What StockIQ Records
Every request an MCP token makes is recorded, and every change it makes is recorded separately and kept longer. Administrators can review both in the product.
| Where | What it holds |
| Admin → Manage Security → MCP Tokens | Each token's name, description, roles, data scopes, expiry and Last Used timestamp — the quickest way to find a token nobody needs any more. |
| Admin → Usage Log | Every request the token made, attributed to the token's Name rather than a user name, so integration traffic is distinguishable from people at a glance. |
| Admin → Audit Trail | Every change a token made, with the before and after value of each field, filterable by caller type, record type, item site and date. Retained substantially longer than the usage log. |
Because changes are attributed to a named token, "which of our integrations changed this setting, and what was it before?" is always answerable. Revoking or deleting a token never erases the record of what it did.
NOTE: These records live in your StockIQ database, which is single-tenant — one database per customer. They are covered by your existing StockIQ data-retention and hosting arrangements. For exact retention periods on your instance, contact support@stockiqtech.com.
Network and Transport
The connection is outbound only, over HTTPS on port 443, using the standard streamable HTTP MCP transport. Your client calls StockIQ; StockIQ never initiates a connection to your network, and no inbound firewall rule is required. There is no separate long-lived event-stream connection to allow for — some general MCP material describes one, but the StockIQ endpoint does not use it.
If traffic is routed through a forward proxy, the proxy must reach your StockIQ instance address and must not strip the Authorization header. Requests are rate limited per token, so a single misbehaving client cannot exhaust the instance for other users.
Shared Responsibility
| StockIQ is responsible for | You are responsible for |
| Authenticating every request, enforcing roles and data scopes, and applying the same gates to external clients as to the web application. | Deciding who gets a token, and granting the least access that does the job. |
| Withholding security administration, outbound email, personal data and shared-memory writes from tokens regardless of roles granted. | Choosing the AI client and provider, and satisfying yourself that its terms meet your policy. |
| Recording every request and every change, attributed to a named token, and retaining those records. | Storing tokens safely, setting expiry, reviewing Last Used, and rotating or deleting tokens that are exposed or no longer needed. |
| Rate limiting so one client cannot degrade the instance. | Reviewing the Usage Log and Audit Trail on your own cadence. |
Questions We Are Commonly Asked
Does connecting an AI assistant train a model on our data?
Not through StockIQ. Whether your data may be used for training is determined by the agreement between you and the AI provider your client is configured against. Enterprise agreements with the major providers generally exclude it; check yours.
Can we allow questions but forbid changes?
Yes. Grant the token read-only roles. It is enforced by the permission system, not by instructions to the assistant.
Can we limit a token to part of our business?
Yes. Apply data scopes for sites, suppliers, buyers, shippers or item categories, exactly as you would for a user.
What happens if a token leaks?
Rotate or delete it in Admin → Manage Security → MCP Tokens; the old value stops working on the next call. Then review the Usage Log and Audit Trail for that token's name to establish exactly what it did. The blast radius is bounded by the roles and scopes it held, and it could not have granted itself more.
Can we try it without exposing production data?
Yes — issue a token scoped to a single site or a narrow item category and a read-only role. That is the recommended way to evaluate it.
How do we turn it off?
Delete the tokens. With no valid token, the endpoint accepts nothing. The add-on can also be removed from your licence.
Getting Help
For a security questionnaire, a data-processing question, or exact retention figures for your instance, contact support@stockiqtech.com. Please refer to tokens by Name and never include a token value.