Sellforte MCP: IT and security FAQ
Answers to the common IT and security questions raised when reviewing the Sellforte MCP server.
This FAQ answers the questions IT and security teams typically raise when reviewing the Sellforte MCP server. The content reflects how the server is built and operated today.
What is the name of the MCP server?
The server is the Sellforte MCP server. Its EU endpoint is https://mcp.sellforte.com/mcp.
Is the source code repository available?
The repository is private Sellforte code and is not available publicly.
What is the source of the MCP server?
Sellforte builds and runs the server as part of the Sellforte platform. The customer does not deploy anything. Users connect from their own AI client, such as Claude, ChatGPT, Copilot or a similar tool, as a remote MCP connector. Authentication grants access to a set of tools that read from the same platform backend that serves the Sellforte web app.
What is the impact if the MCP server is compromised, unavailable, misused, or returns incorrect results?
If the server were compromised, an attacker could read the tenant's Sellforte analytics such as MMM results, ROI, media spend, promotions and optimizer scenarios. They could also create new optimizer scenarios, which is the only write action available to customer users. The server cannot reach any of the customer's own systems outside Sellforte.
If the server is unavailable, only AI assistant access stops. The Sellforte web app keeps working normally.
If the server is misused or returns incorrect results, the AI client could misread or misstate figures. All numbers come from the Sellforte query layer, and the model is instructed never to calculate metrics itself. Every result includes a link to the matching Sellforte dashboard so figures can be verified there. Creating a scenario adds a new plan and does not change existing data. Important decisions should be confirmed in the Sellforte UI.
Are there tools that should be disabled from the server?
No tools need to be disabled. The only write operation available to customer users is creating optimizer scenarios. Existing data is never changed or deleted.
What systems, services, or resources can the MCP server access, and with what rights?
The server reads the tenant's analytics from the Sellforte platform backend, and only that tenant's data. Its one write right is creating optimizer scenarios. The tenant and access are fixed by the user's login, not by anything typed into the AI client.
The server also reads the public Sellforte Support Center knowledge base so answers can reference product documentation.
For its own operation, the server reaches Sellforte's internal AWS services, specifically the customer allowlist on S3 and secrets in AWS Secrets Manager.
The server has no access to the customer's systems, mailboxes, files or ad platforms.
What type of authentication does the MCP server support?
Authentication uses OAuth 2.1 through WorkOS AuthKit, following the MCP authorization specification. Users sign in with their Sellforte account to the WorkOS organization. A near-future migration will move the authentication platform to Descope, which will harmonize login, user management and access with the Sellforte platform experience.
AWS Bedrock AgentCore validates every request's JWT before it reaches the server. The token's organization must be on Sellforte's customer allowlist and is locked to that customer's tenant or tenants. SSO login to the server can be set up when it is already part of the platform login.
What types of data could the MCP server access, process, transmit, or retain?
The server handles internal business information and confidential or proprietary information, including marketing performance, budgets and MMM results. Personal data is limited to the signed in user's identity, specifically the user ID in logs and traces. The analytics themselves are aggregates with no consumer level personal data. The server does not store authentication credentials, API keys or other secrets: OAuth access tokens pass through only for validation. No financial or payment data and no other regulated or sensitive data is handled.
Are inputs and outputs logged?
Yes. On Sellforte's side, tool calls are traced in Sellforte's own MLflow traceability platform on AWS with their inputs, outputs, user and tenant. Each request is also logged in AWS CloudWatch with the method, result, duration and user, but not the payload. Together these form an audit log of actions taken through the MCP server. Data is retained according to the platform scope and agreement.
On the customer's AI client side, that provider's own retention rules apply.
Where is data sent and processed?
The server, its data and its logs run on AWS in eu-west-1 (Ireland), inside Sellforte's AWS account. This matches current Sellforte platform practice. Access goes through AWS CloudFront.
Identity and login are handled by WorkOS.
The MCP server makes no LLM calls itself. The model is the customer's chosen AI client, so tool results are processed wherever that client runs, and that is the customer's choice.