Scopes & Security
Your fleet data is sensitive. The MCP server is designed with security at every layer — from how keys are stored, to what each key can access, to how every request is logged.Scopes
Scopes control which tools an API key can access. When you create a key, you choose which scopes to grant. Tools outside the key’s scopes are invisible to the AI assistant — it doesn’t even know they exist.Available scopes
Scope presets
Principle of least privilege
If someone only needs to ask analytics questions (“How did we do this week?”), create a key with justanalytics:read. The AI won’t have access to individual stops, orders, or driver details — it can only see aggregate numbers.
Key security
How keys are stored
This means:
- Even if the database were compromised, attackers would not have usable API keys
- Bodha Route Planner support staff cannot retrieve your key — only you have it
- If you lose a key, you must create a new one
Key format
Tenant isolation
Every MCP request is scoped to the tenant (organization) that owns the API key. This is enforced at the query level — not just application logic.PII protection
The MCP server masks or excludes personally identifiable information:Rate limiting
Normal conversational use (one person asking questions in an AI assistant) will never hit these limits. They exist to prevent runaway scripts or misconfigured automations.
When a rate limit is hit, the MCP server returns a standard error with a
Retry-After header. AI assistants handle this gracefully — they wait and retry.
Audit logging
Every MCP tool call is logged. The audit log captures:Viewing the audit log
Go to Settings → API Keys → Activity in your Bodha Route Planner dashboard. You can:- Filter by key, tool, or date range
- See which questions triggered which tool calls
- Identify unusual access patterns
- Verify that a revoked key is no longer being used
Retention
Audit logs are retained for 90 days on Pro plans and 1 year on Enterprise plans.Key management best practices
One key per person or application
One key per person or application
Create separate keys for each person or system that connects to the MCP server. This way, if one key is compromised, you can revoke it without disrupting others. The audit log also becomes more useful when each key maps to a known user.
Use the narrowest scopes that work
Use the narrowest scopes that work
If someone only needs analytics, give them
analytics:read. If someone needs routes and stops but not orders, create a key with just routes:read and stops:read. Narrow scopes limit the blast radius of a compromised key.Rotate keys periodically
Rotate keys periodically
While not strictly required, rotating keys every 90 days is good practice. Create a new key, update your AI assistant’s config, and revoke the old key.
Revoke immediately if compromised
Revoke immediately if compromised
If a key is accidentally shared, committed to a public repo, or otherwise exposed:
- Go to Settings → API Keys immediately
- Click Revoke on the compromised key
- Create a new key
- Update your AI assistant’s config
Don't commit keys to version control
Don't commit keys to version control
If you use the MCP server in a team development environment, store the key in environment variables or a secrets manager — not in committed config files. Use
.gitignore to exclude MCP config files.Enterprise security features
Enterprise plans include additional security capabilities:
Contact sales@bodharouteplanner.com for Enterprise pricing.