Privacy, security, and connector notes

What the server does

An MCP client connects to https://mcp.moldraw.com/mcp over Streamable HTTP. The user signs in with their existing MolDraw account through OAuth 2.1 (PKCE). The same endpoint works for every MCP client.

What is stored

• Accounts stay in the existing Supabase Auth project. MCP sign-in counts toward normal monthly active users. There is no separate MCP auth charge.
• Working molecules created through MCP tools are stored as owner-scoped JSON in Redis. Default lifetime is 7 days (MCP_DOCUMENT_TTL_SECONDS=604800). They are not written to a special MCP table in Supabase.
• Share tokens for “open in MolDraw” links use the same Redis TTL.
• Chat transcripts are not stored. The server only sees tool calls and structure data.
• Permanent saved designs continue to use the existing MolDraw project storage when the user saves in the editor.

Security

• OAuth 2.1 with PKCE and dynamic client registration on Supabase Auth.
• Access tokens are verified with the Supabase JWKS (asymmetric keys).
• Every molecule document is checked against the signed-in user id.
• Write tools are annotated separately from read tools.
• Per-user rate limiting (default 120 calls / minute).

Example prompts

Connect and submit

1. Point any MCP client at https://mcp.moldraw.com/mcp.
2. Complete MolDraw sign-in and consent.
3. For directory review: create a test account, attach this privacy page, a 512px logo (/favicon.svg or the site mark), and the three example prompts above.
4. Support: contact.