MCP connector at mcp.tipranks.com

Privacy Policy - MCP Connector

This page describes the data handling specific to the TipRanks MCP connector hosted at https://mcp.tipranks.com. It supplements, and does not replace, the broader TipRanks Privacy Policy, which governs your TipRanks account itself.

What this connector receives

• OAuth authorization grant. When you sign in to TipRanks and approve the connector on the consent screen, we receive your TipRanks user ID, email, subscription tier, and the list of portfolio IDs that exist on your account at that moment.
• Tool call arguments. Each call from your MCP client (e.g. Claude) reaches us with the parameters you or the assistant provided - for example, ticker symbols or a portfolio ID.
• Bearer access tokens on every tool request, used to identify the authorized session.

What we store

• OAuth tokens, hashed. Access and refresh tokens are stored as SHA-256 hashes only; the original token values never touch disk. We store the issuing client, the granted scopes, your TipRanks user ID, email, tier, and authorized portfolio IDs alongside each token record.
• Per-user monthly request counter for rate limiting, keyed by user ID. Reset on the 1st of each month UTC.
• Authorization-code records created during the OAuth flow, kept for 60 seconds and then consumed.
• Dynamic Client Registrations - the redirect URIs and metadata that MCP clients register with us when they first connect.

What we do not store

• The financial data we return (analyst ratings, prices, portfolio holdings, etc.).
• Tool-call payloads or arguments - they pass through and are not persisted.
• Your TipRanks password or session cookies. Sign-in happens on tipranks.com; this server never sees your credentials.
• Any conversation content from your MCP client. We only see the individual tool calls it issues.

Use of data

Stored data is used solely to:

• Authenticate and authorize requests against the right user and scope.
• Enforce per-user monthly rate limits based on your TipRanks tier.
• Restrict portfolio tools to the portfolio IDs you authorized.

We do not use this data for advertising or profiling.

Third-party sharing

We do not sell or share your authorization data with third parties. The data we return to MCP clients is sourced from TipRanks and, for commodities, forex, and crypto, from Financial Modeling Prep. Outbound queries to those services are not tied to your user identity.

Analytics

Our website pages (docs, privacy, dev portal) load Google Analytics (measurement ID G-M6BZF9W1EL) so we can measure traffic patterns and improve the documentation. Google Analytics collects information like your IP address, browser, device, the pages you visit, and referral source.

Analytics runs only on the human-facing HTML pages on mcp.tipranks.com. It does not run on the connector's data endpoints (/mcp, OAuth endpoints, or any API call from your MCP client) — your tool calls and the data we return to your assistant are not sent to Google.

You can opt out of Google Analytics across the web by installing the official Google Analytics Opt-out Browser Add-on or by enabling your browser's "Do Not Track" / tracking-protection feature.

Retention

• Access tokens: hashed, retained for the access-token TTL (1 hour by default).
• Refresh tokens: hashed, retained for the refresh-token TTL (30 days by default).
• Authorization codes: 60 seconds, then deleted on use.
• Rate-limit counters: rolled over on the 1st of each month (UTC).
• Revoked tokens are deleted within 24 hours of revocation.

Revoking the connector inside Claude (or any MCP client) revokes the tokens on our side. You can also remove a connector authorization from your TipRanks account.

Security

All traffic is TLS-only. OAuth follows OAuth 2.1 with PKCE-S256 and Dynamic Client Registration. Refresh tokens are rotated on each use, and attempted reuse of a rotated refresh token revokes the entire token chain.

Your rights and contact

Data-subject requests (access, deletion, correction) covered by GDPR or similar regimes are handled through the TipRanks privacy contact listed in the main privacy policy. For connector-specific issues, contact support@tipranks.com.

Changes to this policy

Material changes will be reflected on this page. The OAuth metadata endpoint advertises this URL as the operator policy URI, so MCP clients can surface the latest version to you when reconnecting.

Last updated: 2026-05-25 · Hosted at https://mcp.tipranks.com/privacy