Skip to main content
The MCP server inherits Qonto’s standard security posture for OAuth integrations. This page summarises the parts most relevant to AI assistants.

​
Identity and authorization

  • Every tool call is authenticated as the consenting Qonto user, using a per-client OAuth access token. There is no shared secret, no API key, and no impersonation.
  • Who may connect at all is controlled by your organization. Owners, admins, and accountants can connect by default; managers and employees only once an owner or an admin has enabled Qonto MCP for the organization. See Who can connect.
  • Your assistant is shown only the tools your role can use, so two colleagues connecting the same organization may see different tools.
  • The server cannot exceed your role. If you are a reporting user, write tools refuse with an authorization error; the LLM will tell you.
  • The set of operations a tool can perform is also constrained by the OAuth scopes you granted at consent time. To grant more scopes, you have to re-authorize.
On the multi-organization endpoint there is a third boundary: the set of organizations you ticked at consent time. Each call is authorized against your role in the organization it names, and a call naming an organization outside that set is refused, even if you are a member of it.

​
Data handling

Connecting the MCP server means your Qonto account data is shared with the third-party AI provider you choose, and that provider — not Qonto — controls what happens to it once it leaves Qonto (including possible retention, training, and onward sharing under its own terms). Read the Terms and Disclosures in full before connecting.
  • The Qonto MCP server is stateless: it does not store conversation content, transcripts, tool inputs, tool outputs, prompts, or any of your business data. It only forwards each tool call to the Qonto Business API and returns the response to your client.
  • Logs retained by the server are limited to operational telemetry: HTTP method, tool name, response status, latency, anonymized organization identifier. They are retained per Qonto’s standard observability policy and are not used for training.
  • The MCP client (Claude, ChatGPT, Cursor, etc.) does see and store conversation data, including tool inputs and outputs. Its retention, training-use, and sharing policies are governed by that vendor, review them before connecting.

​
Strong Customer Authentication

Operations that PSD2 classifies as sensitive (for example, creating certain card types) require SCA in the Qonto mobile app. The MCP server cannot bypass SCA. When a tool needs it, your client surfaces the prompt:
The action needs Strong Customer Authentication. Open Qonto on your phone, approve, and let me know when it’s done.
After you approve in the app, the tool call completes.

​
Rate limits

The MCP server is subject to the same rate limits as the underlying Business API. See Rate limitations for the current ceilings. Bursting tool calls in a chat can trip them; the assistant will tell you and back off.

​
Sensitive data in responses

Some responses contain presigned URLs (statements, attachments, the card iframe URL). They are short-lived credentials. The server hands them back to your client; the client should not echo them in plain text unless you explicitly asked to download or view the artefact. If your client’s UX shows raw tool output, treat presigned URLs as you would a download link, they are valid for anyone who holds them for the duration of their TTL.

​
Allow-listed tool surface

The MCP server only exposes a curated, vetted subset of the Business API. Endpoints outside that subset are unreachable through MCP even if you have an OAuth scope that would otherwise allow them. See What you can do for the full list.

​
Revoking access

You can withdraw a client’s access at any time from the connected apps section of your Qonto account. Once revoked, the MCP client can no longer reach the Qonto API on your behalf and would need to go through the consent flow again to reconnect. Revoking a multi-organization connection withdraws every organization it covered, in one go. Your Qonto data is unaffected, revocation is the equivalent of removing the app from your laptop.

​
Reporting issues

Security issues should be reported at support@qonto.com.