Authentication & Security
Luciq MCP supports two authentication methods. OAuth is recommended for interactive use; token-based auth is available for automation and CI/CD.
OAuth 2.0 (Recommended)
When you connect your IDE to Luciq MCP, OAuth handles everything automatically:
Your IDE discovers the authorization server (via the standard
/.well-known/oauth-protected-resourceand/.well-known/oauth-authorization-servermetadata)Your browser opens to the Luciq authorization page
Log in with your Luciq account and approve access
Your IDE exchanges the authorization code for a token and stores it - this is a one-time step
OAuth uses the authorization-code grant with PKCE (S256) and Dynamic Client Registration (DCR), so no pre-configuration, client secrets, or API keys are needed. Your IDE registers itself and reports its client name automatically during the authorization flow, that's the name you'll see on the consent screen.
Revoking OAuth Access
When you authenticate via OAuth, a token is generated automatically. To revoke access:
Go to Account Management > Luciq MCP in your dashboard
Switch to the Token tab
Delete the active token
Deleting the token cancels all credentials associated with your account, including those generated through the OAuth flow. The next time your IDE tries to connect, it will prompt you to re-authorize.
Token-Based Authentication
For environments where interactive OAuth isn't practical - CI/CD pipelines, remote terminals, automated agent workflows, or programmatic integrations.
Getting a Token
Go to Account Management > Luciq MCP in your Luciq dashboard
Switch to the Token tab
Click Generate authentication token
Copy the token immediately (it's shown once for security)
One token per account, shown once. Each developer has a single MCP token. The full value is displayed only at generation, after that the settings page shows just a short hint (the last few characters) so you can recognize it. To get a new token, revoke the existing one first, then generate again. The same token backs both header-based auth and the OAuth flow, so revoking it also signs out any connected IDE.
Using the Token
Add the Email and Token headers to your MCP server configuration:
Keep your tokens safe. Never commit tokens to version control, share them in Slack or email, or include them in public documentation. If a token is compromised, revoke it immediately from your MCP settings.
Rotating Tokens
Generate a new token from the MCP settings page at any time. Previous tokens can be revoked from the same page.
Permissions & RBAC
MCP access respects your existing Luciq role-based access controls. Authorization is enforced on every tool call in three layers:
MCP access. Your role must grant MCP access at all (the
account_management.mcp.viewpermission). Without it, no tool will run.Per-tool permission. Each tool maps to the same dashboard permission it would use in the UI. For example,
list_crashesneeds crash-list view access,survey_detailsneeds both survey-details and survey-responses view access, andupdate_bugneeds bug-modify access (plus an extra tag-modify permission when you change tags). If your role is missing the permission a tool needs, that call is rejected and the error names the missing permission.Plan entitlement. Tools for a product your plan doesn't include (e.g. APM, Surveys, Crash Reporting) are rejected with a "not included in your plan" message.
Beyond those layers:
App-level access: You can only query data for apps your Luciq account has permissions for
Environment-level access: Production, beta, staging, and other environments follow your existing permission model
Role inheritance: MCP tools inherit the same permissions as the Luciq dashboard - no separate MCP-specific roles
Admin control: Workspace admins manage access through standard Luciq team settings
All tools are always listed, but not always callable. Your client always sees the full set of 29 tools. Whether a given tool succeeds depends on your role and plan, checked at call time. So a tool you aren't entitled to won't disappear from the list, it will return a clear permission or plan error if you call it.
If you're seeing "App not found" or missing data, check with your workspace admin to verify your permissions.
Security Overview
Transport
HTTPS (TLS 1.2+), Streamable HTTP protocol (JSON-RPC 2.0)
Authentication
OAuth 2.0 (authorization-code + PKCE, with Dynamic Client Registration) recommended, or header-based token
Authorization
RBAC - inherits your Luciq workspace permissions, plus plan-feature entitlement, checked on every tool call
Data access
Read-only except update_bug, which can modify a bug's triage state; all writes respect RBAC and are audit-logged
Source code
No source code is accessed, transmitted, or stored
Audit logging
MCP write actions are logged for compliance and auditing, just like dashboard changes
Data residency
Data stays within your Luciq workspace region
What Data Does MCP Access?
MCP tools query the same observability data available in your Luciq dashboard:
Crash reports, stack traces, diagnostics, and occurrence data
App hang / freeze reports
Performance (APM) metrics - network, launches, screen loads, flows, frame drops
User-reported bug reports (submitted via the Luciq SDK)
In-app surveys, NPS, and their responses
App store reviews and ratings
Aggregated app-health insights
Unified Issues and prioritized Opportunities
Application metadata (names, platforms, environments)
Two tools, search_documentation and get_documentation_page, are the exception: they don't touch your workspace data at all. They query Luciq's public documentation site (docs.luciq.ai) to answer SDK integration and feature questions, which is why they're the only tools marked openWorldHint: true.
MCP does not access:
Source code or repository contents
User PII beyond what's already in crash/bug reports (email, device info)
SDK configuration or integration settings
Billing or account information
Rate Limits
MCP requests are rate-limited per client (by IP). The default limit is 100 requests per 60 seconds. If you exceed it, the server responds with a 429 and Rate limit exceeded, wait briefly and retry. In practice, conversational use stays well under this; only tight automated loops tend to approach it.
Clustered Tenants
If your organization uses a dedicated Luciq cluster, your MCP endpoint URL may differ from the default. Contact your Luciq admin or reach out to [email protected] for your cluster-specific endpoint.
Enterprise & Compliance
For enterprise security reviews, compliance questionnaires, or custom deployment requirements, contact [email protected].
Last updated