MCP security & troubleshooting

Hosted MCP security model

  • Tools at https://app.confbuild.com/mcp require an OAuth Bearer token.
  • Authorization codes use PKCE S256, are short-lived, and can be used only once.
  • Access tokens expire after one hour; refresh tokens rotate and expire after 30 days.
  • Every refresh token is redeemable exactly once. Presenting an already-used token counts as theft: the whole token chain of that consent is revoked immediately and the client must obtain consent again.
  • Firestore stores only SHA-256 hashes of issued tokens. Expired tokens and unredeemed authorization codes are removed automatically by a Firestore TTL policy.
  • Client registration stays open as the MCP standard expects, but is capped per caller address and hour. Only a SHA-256 fingerprint of that address is stored, never the address itself.
  • The verified Firebase UID determines the private owner path. Project links and tool arguments cannot select another private owner path.
  • The remote backend adapter uses Admin SDK only inside this server-selected UID path. Firestore and Storage Rules additionally protect the browser render channel.
  • Public or read-only projects are cloned privately before editing.
  • Project commits use revision protection against silent concurrent overwrites.
  • The server calls no OpenAI, Anthropic, Gemini, or confBuild AI API.
  • For support and abuse control, confBuild stores the exact request passed to confbuild_start_design_session and the latest committed Sheet state in admin-only history. It does not store private model reasoning, model messages, screenshot analysis, screenshots, or the final summary there.
  • For operations and capacity analysis, confBuild additionally records tool calls, timestamps, duration, success/error code, input/output sizes, Sheet quantities, commits, project actions, and render activity. To show connection status, the backend also stores the OAuth client name, authorization lifetime, and last activity below the respective user’s scope. These records contain no prompt text, cell values, image data, error messages, or reasoning content. Detail events expire through Firestore TTL after 90 days; daily aggregates remain.

Approve access only when the consent page shows the expected client plus the MCP-history and technical-usage notices. Never put passwords or Firebase tokens in MCP configuration fields or user prompts. The MCP client receives its own OAuth token, not your confBuild password.

Revoking access currently requires the relevant OAuth client to be disabled on the server. A user-visible connected-client screen and individual token-revoke actions are planned improvements.

Tools that write projects

  • confbuild_create_project
  • confbuild_clone_project
  • confbuild_begin_edit when it auto-clones
  • confbuild_commit_edit
  • confbuild_restore_project_snapshot

confbuild_apply_sheet_patch changes only the temporary edit session. confbuild_discard_edit drops that working copy but does not delete a saved project. Commits keep pre-commit rollback snapshots inside the project’s own storage; snapshots stay in the owner’s private path and are pruned automatically.

The finish call’s structured outcome (completion state, iteration count, fixed/residual defect categories) is stored as content-free enums only; the free-text summary the agent shows the user is never persisted.

Private browser render channel

A render job is created under mcpRenderJobs/<uid>/jobs/<jobId>. Only the signed-in owner can read it and add the permitted capture fields. Screenshots are stored under mcp-renders/<uid>/<jobId> and are not public.

The hosted MCP does not take over arbitrary tabs. It accepts capture work only from the matching confBuild project signed in with the same UID. Local developer CDP mode is separate.

Common failures

Cause: The client lacks Remote MCP/OAuth support, uses the wrong transport, or cached old metadata.

Fix: Use exactly https://app.confbuild.com/mcp with Streamable HTTP/Remote MCP. Remove and re-add the connection. Do not enter an /oauth path or Cloud Function URL manually.

Cause: Expired confBuild session, wrong account, blocked redirect, or invalid OAuth request.

Fix: Open and sign in to https://app.confbuild.com first, then reconnect from the MCP client. Check whether popup or redirect blocking prevents returning to the client.

invalid_token

Cause: The access token expired, was revoked, or belongs to another resource.

Fix: Reconnect the client or repeat OAuth consent. Never copy tokens between clients.

invalid_grant reporting an already-used refresh token

Cause: The same refresh token was redeemed twice — a copied MCP configuration including its token, two instances of the same client running in parallel, or a leaked token. As a safeguard the entire token chain of that consent was revoked.

Fix: Remove the connection in the client and grant OAuth consent once more. Delete copied client configurations that contain tokens on every other machine; each machine needs its own consent.

“No accessible confBuild project was found”

Cause: Wrong ID, unsupported URL, project is not public, or project is not in the current account.

Fix: Use a supported /e/, /editor/, /p/, or /lib/ URL or the correct ID. Another user’s private project cannot be discovered by ID.

“The project is read-only”

Fix: Use confbuild_begin_edit with cloneReadOnly: true, or call confbuild_clone_project first. The original remains unchanged.

REVISION_CONFLICT

The project changed in the browser or another agent after the edit session began. Re-read the latest version, deliberately rebase the changes, validate, and commit again. There is intentionally no force-overwrite switch.

“Validation failed”

Inspect confbuild_validate_edit and correct every item under errors. Warnings do not automatically block commit, but require professional evaluation.

“Commit the dirty edit before rendering”

The browser can load only a persisted revision. Validate and commit the edit, or abandon it with confbuild_discard_edit.

Render job remains running or expires

  1. Open the exact requested project in the browser.
  2. Use the same confBuild account for browser and MCP.
  3. Wait until the 3D scene is fully loaded.
  4. Keep the tab open.
  5. Continue polling the same renderJobId; do not create a duplicate job. Prefer waitMs so the server waits in place.

While no signed-in editor tab with the project open has claimed the job, confbuild_get_render_result reports it as unclaimed after a few seconds, including how long it has been pending — that hint appears long before the job expires, so act on it instead of waiting out the expiry.

No images in the result

After completed, call confbuild_get_render_result with includeImages: true and maxImages from 1 to 4. If the job is failed, address its error text first.

Session is missing or expired

Remote design and edit sessions expire after roughly six hours; render state after at most 24 hours. Start a new session from the last committed project. Committed changes remain intact.

Large Sheets or missing chunks

Do not bypass the manifest manually. Re-save or clone from a complete version. MCP safety limits are 2,000,000 cells and 450 chunks per commit.

Known limitations

  • Screenshots require the matching open confBuild tab.
  • Multiple tabs for one project may notice the same render job; a future lease should select one tab.
  • MCP history is currently visible only to administrators; user-facing export/deletion, OAuth-connection management, and project rollback are not yet available.
  • Structural validation is not a structural, manufacturing, building-code, collision, or solver certificate.
  • MCP remains coupled to the current project/chunk schema.
  • Dynamic client registration is rate limited, and expired tokens, codes, and counters are cleaned up by a TTL policy. Abandoned client registrations still persist, and abuse monitoring is missing before very broad distribution.

Security checklist

  • Verify the expected MCP client on the OAuth page
  • Share private project links only with authorized people
  • Clone public templates instead of modifying originals
  • Rebase revision conflicts; never bypass them
  • Review the final screenshot and diagnostic report
  • Require human approval for safety, structural, standards, and manufacturing assumptions
  • Have unused MCP connections disabled

More help

For setup problems, start with set up MCP. Tool arguments and patch formats are in the MCP tool & Sheet reference.

Back to Documentation