Appearance
MCP Access Model v3.2
Last updated: July 22, 2026
AI4Love provides an MCP (Model Context Protocol) server that lets AI assistants — Claude, ChatGPT, or any MCP-compatible client — query your supporter data conversationally. This page explains exactly what the assistant can see, what it can do, and how access is controlled.
How It Works
Staff member AI Assistant MCP Server Airtable
│ │ │ │
│── "Who are our at-risk" ──▶│ │ │
│ │── MCP tool call ───────▶│ │
│ │ │── validate key ───▶│
│ │ │◀── key valid ──────│
│ │ │── query data ─────▶│
│ │ │◀── records ────────│
│ │ │── format for ──┐ │
│ │ │ tool's purpose│ │
│ │ │◀────────────────┘ │
│ │◀── formatted answer ────│ │
│◀── formatted answer ──────│ │ │- Staff asks a question in their AI assistant
- The assistant calls one of the 42 tools available to authenticated clients
- The MCP server validates the caller's OAuth token or API key
- If valid, the server queries that organization's dedicated working base — never another organization's
- Most tools format a bounded, purpose-specific response (see Data Minimization below); two tools are handled differently
- Results return to the assistant for response formatting
Unauthenticated clients skip straight to 3 diagnostic tools (health check, auth status, identity) and never reach step 4 — no supporter data is reachable without valid credentials.
What the Assistant Can Do
Authenticated clients see 42 tools, grouped by purpose:
| Category | Examples | Behavior |
|---|---|---|
| Diagnostics (3) | health_check, auth_status, whoami | Read-only, no authentication required |
| Supporter & activity queries (11) | get_supporter, list_supporters, get_donations, list_volunteers, list_engagements, get_participation, list_events, get_supporter_timeline, export_supporters | Read-only |
| Intelligence & operations (12) | get_insights, get_at_risk_supporters, get_conversion_opportunities, get_recognition_queue, get_campaign_recommendations, get_relationship_alerts, get_resurrection_opportunities, list_campaigns, get_generated_campaign, list_team, daily_overview, get_summary_stats | Read-only |
| Research & schema (3) | query_kindmind, query_vault, get_schema | Read-only |
| Visual scenes (8) | supporter_pulse, morning_brief, at_risk_brief, recognition_brief, resurrection_brief, conversion_brief, foundation_stats, campaigns_brief | Read-only; return structured display instructions so a compatible client can render a multi-panel artifact instead of plain text |
| Narrowly gated writes (2) | add_to_kindmind, mark_campaign_refined | The only tools that write anything — see below |
40 of the 42 tools are read-behavior only — no creates, modifies, or deletes, under any circumstances.
The 2 gated write tools, precisely:
add_to_kindmindwrites curated research content to Pinecone. It is restricted to allowlisted curator organizations — most client organizations cannot call it at all.mark_campaign_refinedupdates organization-scoped Generated Campaign metadata in Airtable, marking a campaign as refined after a staff member has iterated on it in conversation.
Neither write tool touches supporter source data. No tool can create, modify, or delete a People, Donors, Volunteers, Engagements, or Participation record.
What the Assistant Cannot Do
- Create, modify, or delete any supporter record, under any tool
- Access another organization's data — every request resolves to exactly one org
- Trigger outreach, send messages, or take action outside the two narrowly scoped writes described above
Access Controls
Authentication
Each request carries either an OAuth token or a provisioned per-organization API key, checked with timing-safe comparison. There is no long-lived session for the standard (Streamable HTTP) transport — every request revalidates the credential independently. Clients connecting over SSE hold a short-lived, in-memory session tied to that connection; it ends when the client disconnects or the underlying OAuth access token expires (maximum TTL 60 minutes).
Organization Isolation
Each MCP request resolves to a specific organization, which maps to a dedicated working base and credential set. A user authenticated for Organization A cannot query Organization B's data — this is enforced at the credential routing layer, not by a filter applied after the fact.
Transport Behavior
Streamable HTTP (used by ChatGPT and most connectors) intentionally returns MCP-level authentication errors rather than an HTTP 401, so that compatible connector sessions stay alive instead of dropping the connection on an auth hiccup. This is a deliberate compatibility choice, not a security gap — unauthenticated calls to data tools still fail; they just fail with a different error shape.
Request Limits
Being direct about the current state here, because a trust page that overstates its own controls is worse than one that's candid: individual tools apply their own query and response bounds (e.g., export_supporters defaults to 100 records per call). A fixed per-key request quota, a daily retrieval cap, and automated anomaly detection across the MCP surface are not currently enforced in the application code. If your organization needs a hard per-key rate limit or daily cap as a contractual requirement, that is a deployment-level control we can configure and verify before publishing a specific number for your account — we won't publish a limit here that the code doesn't actually enforce.
Data Minimization
Most MCP tools are purpose-built: each tool's response format hard-codes the specific fields it renders for a normal query (e.g., get_supporter returns name, status, donation total, volunteer hours, region — not a raw record dump), so typical conversational usage returns a bounded, tool-specific projection rather than every field on the record.
Two tools are intentionally broader, and we'd rather flag that here than let this page imply otherwise:
get_schemareturns field-level metadata for approved tables — that's its purpose.export_supportersaccepts a caller-specified list of fields and returns whatever exists on the record for each one requested. It is not currently constrained to a fixed allow-list at the code level.
Both require authentication and are scoped to the caller's own organization. New Airtable fields — including any that carry sensitive information — are reviewed for MCP exposure before being added to a base that has MCP access enabled, since the schema and export tools don't filter by field sensitivity on their own.
The LLM Data Path
When the MCP server returns data to the AI assistant, that data transits through the LLM provider's infrastructure.
| Provider | Tier | Training | Retention |
|---|---|---|---|
| Anthropic (Claude) | API (commercial) | No — excluded from training by API terms | Up to 30 days for trust & safety, then deleted |
| OpenAI (ChatGPT) | API (commercial) | No — excluded from training by API policy | Up to 30 days for abuse monitoring, then deleted |
Both providers offer zero-retention configurations, available depending on contract tier.
Your options:
- Restrict MCP to a single LLM provider
- Disable MCP entirely (AI-generated insights in Airtable continue to work independently of MCP)
Audit Trail
Every MCP request is logged with:
| Field | Example |
|---|---|
| Tool name | get_at_risk_supporters |
| Organization ID | org_stf |
| Auth type or error code | oauth, AUTH_MISSING, AUTH_INVALID |
| Result status | ok, error |
| Timestamp | 2026-07-21T14:32:01Z |
Credentials and response bodies are never logged. Record counts and response-time metrics are not currently part of the MCP application log contract — if your compliance review needs those fields, ask; adding them is a scoped change we can make, not something already shipping.
Logs are available in Vercel runtime logs (plan-dependent retention — one day by default on Pro, longer via Observability Plus or Log Drains) or streamed to an external destination for partners who need longer retention.
Disabling MCP
MCP is optional. If your organization prefers not to expose supporter data through AI assistants:
- Remove the organization's provisioned access key, or
- Request that AI4Love disable MCP access for your entire organization
AI-generated insights continue to appear in the dashboard — they're written directly to Airtable by the nightly agents and don't depend on MCP.