MCP connector at mcp.tipranks.com
Privacy Policy - MCP Connector
This page describes the data handling specific to the TipRanks MCP
connector hosted at https://mcp.tipranks.com. It supplements,
and does not replace, the broader
TipRanks Privacy Policy,
which governs your TipRanks account itself.
What this connector receives
- OAuth authorization grant. When you sign in to TipRanks and approve the connector on the consent screen, we receive your TipRanks user ID, email, subscription tier, and the list of portfolio IDs that exist on your account at that moment.
- Tool call arguments. Each call from your MCP client (e.g. Claude) reaches us with the parameters you or the assistant provided - for example, ticker symbols or a portfolio ID.
- Bearer access tokens on every tool request, used to identify the authorized session.
What we store
- OAuth tokens, hashed. Access and refresh tokens are stored as SHA-256 hashes only; the original token values never touch disk. We store the issuing client, the granted scopes, your TipRanks user ID, email, tier, and authorized portfolio IDs alongside each token record.
- Per-user monthly request counter for rate limiting, keyed by user ID. Reset on the 1st of each month UTC.
-
Per-request usage log. For each tool request we keep
metadata only: a timestamp, the name of the tool invoked (for example
get_stock_quotes), the HTTP status and response time, your subscription tier, and rate-limit counts. We use it to enforce quotas, debug errors, and understand which tools are useful. It never includes the arguments you passed or the data we returned, and it is deleted automatically after 30 days. - Authorization-code records created during the OAuth flow, kept for 60 seconds and then consumed.
- Dynamic Client Registrations - the redirect URIs and metadata that MCP clients register with us when they first connect.
What we do not store
- The financial data we return (analyst ratings, prices, portfolio holdings, etc.).
- Tool-call arguments - the parameters passed to a tool (a ticker symbol, a portfolio ID, and so on) pass through and are not persisted. We record the name of the tool that was called, but never the values you sent to it.
- Your TipRanks password or session cookies. Sign-in happens on
tipranks.com; this server never sees your credentials. - Any conversation content from your MCP client. We only see the individual tool calls it issues.
Use of data
Stored data is used solely to:
- Authenticate and authorize requests against the right user and scope.
- Enforce per-user monthly rate limits based on your TipRanks tier.
- Restrict portfolio tools to the portfolio IDs you authorized.
We do not use this data for advertising or profiling.
Third-party sharing
We do not sell or share your authorization data with third parties. The data we return to MCP clients is sourced from TipRanks and, for commodities, forex, and crypto, from Financial Modeling Prep. Outbound queries to those services are not tied to your user identity.
Analytics
Our website pages (docs, privacy, dev portal) load
Google Analytics
(measurement ID G-M6BZF9W1EL), delivered through Google Tag
Manager, so we can measure traffic patterns and improve the
documentation. Google Analytics collects
information like your IP address, browser, device, the pages you
visit, and referral source.
Analytics runs only on the human-facing HTML pages on
mcp.tipranks.com. It does not run on the
connector's data endpoints (/mcp, OAuth
endpoints, or any API call from your MCP client) — your tool calls
and the data we return to your assistant are not sent to Google.
We also record, in a first-party cookie, the page you first landed on —
including any marketing parameters in its address (for example a Google
Ads gclid or utm_* campaign tags). If you
create a developer account, that landing URL is stored with your account
so we can understand which channels bring developers to the connector.
It is first-party (set by mcp.tipranks.com, never shared
with the rest of the web) and holds only the address you arrived on — no
browsing history.
You can opt out of Google Analytics across the web by installing the official Google Analytics Opt-out Browser Add-on or by enabling your browser's "Do Not Track" / tracking-protection feature.
Retention
- Access tokens: hashed, retained for the access-token TTL (1 hour by default).
- Refresh tokens: hashed, retained for the refresh-token TTL (30 days by default).
- Authorization codes: 60 seconds, then deleted on use.
- Rate-limit counters: rolled over on the 1st of each month (UTC).
- Per-request usage log: 30 days, then deleted automatically.
- Revoked tokens are deleted within 24 hours of revocation.
Revoking the connector inside Claude (or any MCP client) revokes the tokens on our side. You can also remove a connector authorization from your TipRanks account.
Security
All traffic is TLS-only. OAuth follows OAuth 2.1 with PKCE-S256 and Dynamic Client Registration. Refresh tokens are rotated on each use, and attempted reuse of a rotated refresh token revokes the entire token chain.
Your rights and contact
Data-subject requests (access, deletion, correction) covered by GDPR or similar regimes are handled through the TipRanks privacy contact listed in the main privacy policy. For connector-specific issues, contact support@tipranks.com.
Changes to this policy
Material changes will be reflected on this page. The OAuth metadata endpoint advertises this URL as the operator policy URI, so MCP clients can surface the latest version to you when reconnecting.