---
title: "MolDraw MCP privacy and security"
url: https://www.moldraw.com/pages/mcp-privacy.html
description: "How the MolDraw MCP server works: OAuth 2.1 sign-in with your MolDraw account, what is stored and for how long, security, and how to connect any MCP client."
lang: en
publisher: Scidart Academy
generated: 2026-11-04
---
MolDraw MCP

# Privacy, security, and connector notes

The remote MCP server is an agent interface to MolDraw. It is not a second MolDraw application.

[← Back to MolDraw](https://www.moldraw.com/) · [Site privacy policy](https://www.moldraw.com/pages/privacy-policy.html)

## What the server does

An MCP client connects to `https://mcp.moldraw.com/mcp` over Streamable HTTP. The user signs in with their existing MolDraw account through OAuth 2.1 (PKCE). The same endpoint works for every MCP client.

## What is stored

- **Accounts** stay in the existing Supabase Auth project. MCP sign-in counts toward normal monthly active users. There is no separate MCP auth charge.
- **Working molecules** created through MCP tools are stored as owner-scoped JSON in Redis. Default lifetime is 7 days (`MCP_DOCUMENT_TTL_SECONDS=604800`). They are not written to a special MCP table in Supabase.
- **Share tokens** for “open in MolDraw” links use the same Redis TTL.
- **Chat transcripts are not stored.** The server only sees tool calls and structure data.
- Permanent saved designs continue to use the existing MolDraw project storage when the user saves in the editor.

## Security

- OAuth 2.1 with PKCE and dynamic client registration on Supabase Auth.
- Access tokens are verified with the Supabase JWKS (asymmetric keys).
- Every molecule document is checked against the signed-in user id.
- Write tools are annotated separately from read tools.
- Per-user rate limiting (default 120 calls / minute).

## Example prompts

**Draw caffeine.**

**Change the methyl group at position 7 to ethyl.**

**Give me the SMILES, then export SVG.**

## Connect and submit

1. Point any MCP client at `https://mcp.moldraw.com/mcp`.
2. Complete MolDraw sign-in and consent.
3. For directory review: create a test account, attach this privacy page, a 512px logo (`/favicon.svg` or the site mark), and the three example prompts above.
4. Support: [contact](https://www.moldraw.com/pages/contact.html).