Security best practices

Use Signitic’s MCP Server with a trusted client and keep control of the information the client can access or share.

Connect over Streamable HTTP

The official Signitic MCP endpoint is https://mcp.signitic.com/mcp. It uses HTTPS and Streamable HTTP. Check the URL before supplying your personal Uma API key; do not send the key to an endpoint you do not trust.

Each user generates their own key in Account → Uma. Store it in a private client configuration or secret store, and do not paste it into prompts or share it with other users. Your Signitic permissions determine which workspace data the key can access. A workspace administrator must enable MCP access for that workspace.

Protect against prompt injection

Tool results can include user-entered names, campaign or group details, and Help Center content. Treat that text as data, not as instructions for the AI client. Content returned by a tool should not override your request or the client’s security rules.

• Review unusual instructions that appear inside retrieved content, especially requests to reveal a key, disclose unrelated data, or call another service.

• Check the client’s response before you use or share it. Confirm that any data it includes belongs to the workspace and task you intended.

• Be careful when the same client also has access to other tools or apps. Signitic’s MCP tools are read-only, but another connected tool may be able to send or change data.