Security and access
How the DUET MCP connector signs users in, what it can reach, and how to revoke access, for IT and security teams.
This page is for teams that review AI connectors before allowing them in their organization.
Summary
- The connector is a remote MCP server at
https://mcp.enurgen.com/mcp, using the Streamable HTTP transport. - Users sign in with their own DUET account through OAuth 2.1. The assistant never sees the user's password.
- Every tool is read-only. The connector can't create, edit, or delete anything in DUET.
- The connector returns only the sites the signed-in user can open in DUET. Admin roles in DUET grant no extra access through the connector.
Sign-in
The connector follows the MCP authorization specification: OAuth 2.1 with PKCE. Assistants discover how to sign in from the connector itself, so there are no client IDs or secrets to configure.
- The assistant sends the user to DUET to sign in.
- DUET shows a consent page that names the assistant, when DUET recognizes it. For an assistant DUET doesn't recognize, the page warns the user to continue only if they started the connection there.
- The user allows or cancels the request.
- The assistant receives a single-use code and exchanges it for tokens.
Tokens
- Access tokens expire after one hour. The assistant refreshes them automatically.
- Refresh tokens rotate on every use.
- A connection that goes unused for 90 days expires, and the user signs in again.
- Tokens work only with the connector. They can't call the Platform API or the DUET app.
Data access
- The connector reads the same data as the DUET dashboards and reports, filtered by the user's access.
- Each request covers at most 92 days and 100 sites.
- Each user can make up to 120 requests a minute.
Revoke access
Users can remove an assistant from their DUET account page, under Connected apps. Access ends immediately, and the assistant's tokens stop working.
Network
If your network restricts outbound traffic, allow HTTPS to mcp.enurgen.com and app.enurgen.com. Assistants that run in the vendor's cloud, such as Claude and ChatGPT on the web, call the connector from the vendor's network, not yours.