Model Context Protocol Connector Privacy Addendum

SHARE THIS PAGE:

Overview

This Model Context Protocol (MCP) Connector Privacy Addendum describes how the Federal Reserve Bank of St. Louis ("we," "us," or "our") handles data when you use our read-only MCP connector within OpenAI (ChatGPT, Codex) or Anthropic (Claude) systems. This Addendum supplements our Online Privacy Notice and applies solely to interactions conducted through the MCP connector.

Read-Only Design

Our MCP connector is strictly read-only. It retrieves information from our systems based solely on user-initiated queries. It does not write, modify, or delete any data.

Data Collection

The MCP connector does not require users to enter any personally identifiable information (PII) beyond authentication credentials, when applicable. No other PII is collected, processed, stored, or transmitted by the connector.

Authentication Credentials

Certain resources accessed through the MCP connector may require authentication. Any credentials transmitted through the connector are sent securely using TLS (HTTPS). We do not store long-lived authentication credentials. When tokens are used, they are scoped and short-lived.

Logging and Redaction

We minimize the information stored in logs. Logs contain only non-PII technical metadata such as correlation identifiers. We redact PII before writing to logs and avoid storing raw user prompts unless absolutely necessary for debugging.

Data Retention and Deletion

Data retention is minimal:

  • Operational logs containing correlation IDs are kept for up to 90 days for security and debugging.
  • Authentication-related data (if any) is retained only as long as required for access control.

Users may request deletion of any authentication-associated information by contacting our Privacy Office.

Security Measures

All MCP connector communications use TLS encryption. We employ industry-standard security controls, including server-side input validation and protections against malicious or malformed inputs.

Interaction with OpenAI Systems

When you use the MCP connector via OpenAI, OpenAI’s systems may relay your query ("App Request") to our API and return our corresponding response ("App Response") through their platform. We process these requests solely to fulfill your query and comply with applicable law.

Interaction with Anthropic (Claude) Systems

When you use the MCP connector via Anthropic’s Claude, Claude sends your query to our API and relays our response back to you. We process these requests solely to fulfill your query and comply with applicable law.

AI Provider Disclosures

To ensure transparency, we disclose the providers involved:

  • OpenAI: API data is not used for model training by default.
  • Anthropic (Claude): API calls are not used for model training and may be subject to short-term abuse monitoring logs.

Cookies and Analytics

Our MCP connector does not use cookies or analytics tools. Any cookies described in our Online Privacy Notice apply only to our public websites.

Contact

For questions or privacy-related requests, contact Data.Privacy@stls.frb.org.