Security

Security overview

The platform keeps secrets server-side, scopes access by tenant membership and role, validates external input, and records key administrative actions in audit trails.

MCP connector security

The Lymwave remote MCP server uses HTTPS and workspace-scoped authorization. Its Claude connector flow uses OAuth Authorization Code with S256 PKCE, exact redirect and resource validation, short-lived access tokens, rotating refresh tokens, and revocation. Custom-client bearer tokens are shown to the user when created. Lymwave stores only server-side token and code hashes plus the metadata needed to validate, expire, and revoke access.

Public tools separate read operations from draft mutations and declare their access behavior through MCP tool annotations. The public MCP surface does not include direct publishing, deletion, payment, AI media generation, or sponsored-placement tools. Draft mutations remain subject to workspace access, subscription, quota, input-validation, and rate-limit controls.

The MCP gateway limits request size, validates JSON content type and JSON-RPC structure, rejects untrusted browser origins, publishes protected-resource metadata, returns an HTTP authentication challenge for missing or invalid credentials, and forwards authorized tool requests to a secret-protected first-party application route. Tokens are accepted only in the Authorization header. Operational logs omit raw tokens and full content bodies.

Users should issue one least-privilege token per client, store it in that client's secret manager, rotate or revoke it when access changes, and never place it in a URL, prompt, article, repository, or support message.

Reporting a security issue

Send security reports to hello@lymwave.com with a concise description, affected endpoint, reproduction steps, and impact. Do not include customer data, access tokens, or other secrets in the initial message.