Security and data handling
| Concern | How it is handled |
|---|---|
| Credentials | The server never requests, receives, or stores consumer keys or secrets. Signing happens entirely in your application. |
| Authentication | None required. The server exposes public documentation and guidance only. See Why Learnosity Build Aide MCP does not require authentication. |
| Write access | None. Every tool is read-only, and no tool changes state. |
| Usage data | Anonymised operational metrics (tool name, timing, error type) are collected to monitor service health. Client identifiers are a keyed digest of the connecting address, which the server cannot reverse. Raw IP addresses are not retained in metrics. |
| Proprietary content | Raw documentation source files remain server-side. Clients receive structured responses, not the underlying corpus. |
Note: Learnosity cannot control what you paste into your AI assistant, or how that assistant's model handles it. The MCP server itself will never ask for a secret - but standard practice applies: keep credentials in environment variables and out of your chat window, whatever tooling you are using.
Why Learnosity Build Aide MCP does not require authentication
The Learnosity Build Aide MCP server does not require authentication because it provides access only to publicly available Learnosity documentation and integration guidance. The server does not store credentials or sign API requests, and all available tools are read-only.
Rate limits help protect the service from excessive requests and maintain availability for users. For more information, see Rate limits.
This authentication model applies to the currently available tools and documentation sources. Introducing tools that modify data or provide access to nonpublic information would require a review of the authentication and security requirements.
Rate limits
MCP-protocol requests are rate limited at three levels to protect service quality for all users.
| Limit | Threshold | Window |
|---|---|---|
| Per session | 20 requests | 5 seconds |
| Per client, across all sessions | 100 requests | 5 seconds |
| Global (all clients) | 900 requests | 5 seconds |
When a limit is exceeded, the client receives a JSON-RPC error with code -32000. Health-check endpoints are not affected. The error message names the scope, the limit, and how long to wait before retrying.
These limits are set well above normal interactive use. A single developer working conversationally will not encounter them. If you are consistently hitting the per-session limit, it usually indicates an agent looping - check your assistant's tool-call behavior before assuming a service problem.
Content freshness
The server always serves current Learnosity documentation. It refreshes automatically from the published sources, so there is no local copy to maintain, no cache to clear, and no redeployment or client update required on your side.
Reporting a security issue
If you believe you have identified a security vulnerability in the Learnosity Build Aide MCP server, submit a support ticket and identify it as a security issue.
Include the affected tool or resource and the steps required to reproduce the issue.
The Learnosity support team forwards security reports directly to the Learnosity security team.
Do not use the Learnosity MCP feedback page to report security vulnerabilities. Submit a support ticket to ensure the issue is directed to the appropriate team.
Limitations
- The tool surface is evolving. Available skills and tools expand regularly. Behavior may change between releases.
- Development-time only. No runtime, delivery, or live-API capability. See What Learnosity Build Aide MCP does not do in the About Learnosity Build Aide MCP article..
- Documentation-bounded. The server is only as accurate as the underlying Learnosity documentation. Where documentation is incomplete, the server's results will be too, and we are actively closing those gaps.
- Assistant behavior varies. Different clients and models make different decisions about when to consult an MCP server. Naming the server explicitly in your prompt produces the most consistent results.