MCP security

The TwinCommit MCP server is designed so that connecting an AI assistant never widens access to your data. It is read-only and redacts row values by default, and it can only reach the TwinCommit control endpoints you point it at.

Defaults

Control	Default	Change with
Write tools (`start_pipeline`, `stop_pipeline`, `resnapshot_table`)	disabled	`TWINCOMMIT_MCP_ALLOW_WRITES=true`
Row values in `tail_events`	redacted	`TWINCOMMIT_MCP_ALLOW_ROW_VALUES=true`
Database access	none; the MCP server never connects to sources or targets	not configurable
Audit log	on	`TWINCOMMIT_MCP_AUDIT_LOG`

Authentication

Protect each pipeline’s control endpoints with a token:

control:
  token: ${TWINCOMMIT_CONTROL_TOKEN}
  allow_writes: true      # pipeline-side switch; both sides must allow writes

Then give the MCP server the same token with TWINCOMMIT_TOKEN. Without a valid token, /status and /control return 401. /metrics stays open for Prometheus unless you set control.protect_metrics: true.

Defence in depth

A write needs both TWINCOMMIT_MCP_ALLOW_WRITES=true on the MCP side and control.allow_writes: true on the pipeline. Production pipelines can refuse writes even if a developer’s MCP client allows them.

Audit log

Every tool call is appended as a JSON line:

{"ts":"2026-11-14T14:10:00Z","tool":"resnapshot_table","args":{"pipeline":"db2-prod","table":"SALES.ORDERS"},"result":"ok","client":"claude-code"}

Pipelines also log every control request they receive, so the audit trail exists on the server side too.