Home 📖 Features & How-To 🔒 Search Atlas MCP Connector Security Review

🔒 Search Atlas MCP Connector Security Review

Last updated on Oct 26, 2026

🔍 Overview

The Search Atlas MCP connector lets an AI assistant, such as Claude, use Search Atlas tools on your behalf. IT and security teams usually want written answers before enabling a connector for a whole company workspace. This article lists the topics reviewers typically ask about, explains how to evaluate each one, and shows how to get formal documentation.

Important: Compliance attestations, token settings and legal terms must be confirmed in current, written form. This article does not replace those documents. Please do not rely on a help article alone for a formal vendor review.

📋 What Security Teams Usually Ask For

  • Connector status: whether the connector is generally available, in beta, or listed in a specific directory.
  • Compliance attestations: SOC 2 Type II and ISO 27001 reports or certificates, including the report period and scope.
  • OAuth details: requested scopes, access and refresh token lifetimes, revocation, and SSO behavior.
  • Read-only options: whether access can be limited to viewing data without making changes.
  • Tool-change notification: how you are told when tools are added, renamed, or changed.
  • Audit logging: what activity is recorded and how you can export it.
  • Data handling: DPA, subprocessor list, data location, and retention.
  • Credits and billing: how MCP tool calls are counted against your plan.

🔐 How Access and Authentication Work

The connector uses an OAuth-style sign-in. Each person who connects is sent to Search Atlas to log in and approve access. The assistant can then only work within what that person's Search Atlas account is allowed to see and do. This means:

  • Your existing Search Atlas roles and project access still apply.
  • Each user connects individually, so you can add or remove people one at a time.
  • Passwords are never entered into the AI assistant itself.

For the exact scopes, token lifetimes, and how SSO sign-in interacts with the connector, ask for written confirmation (see the request steps below). These values should be stated in a dated document your team can file.

🛡️ Compliance and Attestations

For SOC 2 Type II and ISO 27001, reviewers should ask for the current report or certificate and check three things:

  1. The report period and the date it was issued.
  2. Whether the scope covers the Search Atlas platform and the MCP connector.
  3. Any exceptions or qualified opinions noted by the auditor.

Ask our team for the current documents directly rather than relying on a public statement. Documents can be shared under NDA if needed.

👁️ Read-Only Access

If your policy requires read-only use, you can reduce risk in several ways:

  • Have users connect with a Search Atlas role that has view-only permissions.
  • Limit which projects and workspaces the connecting accounts can reach.
  • In your Claude workspace, review which tools the connector exposes and disable any that can create or change data, if your plan supports per-tool controls.

Ask us to confirm in writing whether a dedicated read-only scope is available for the connector today.

🔔 Tool Changes and Audit Logging

An MCP connector exposes a list of tools, and that list can change over time. To stay in control:

  • Record the tool list at the time of your approval.
  • Re-check the list in your Claude workspace periodically, and after any product announcement.
  • Ask us how tool changes are announced and whether advance notice is provided.

For audit logging, check two places: your Claude workspace's admin logs, which show connector use on that side, and the activity history in Search Atlas. Ask us to confirm what is logged on the Search Atlas side and whether logs can be exported.

📄 Data Handling, DPA and Subprocessors

When the assistant calls a Search Atlas tool, data from your account is returned to the assistant and processed under your AI provider's terms as well as ours. Your review should cover both. Request these from us:

  • The Data Processing Agreement (DPA).
  • The current subprocessor list and how changes are communicated.
  • Data retention and deletion terms.
  • Where data is stored and processed.

Also review your AI provider's data handling terms for your specific plan.

💳 Credits and Billing

Reviewers often ask whether MCP tool calls cost extra. Check the usage and billing page in your Search Atlas account to see how credits are used on your plan. Because usage can add up when many team members run automated requests, we suggest:

  • Starting with a small pilot group.
  • Monitoring credit usage during the first few weeks.
  • Asking us to confirm in writing how each MCP tool is counted against your plan.

✅ Recommended Rollout Steps

  1. Collect your security questionnaire and the list of topics above.
  2. Request written confirmation and documents from our team (see below).
  3. Run a pilot with a few users on a test project.
  4. Document the approved tool list, roles, and credit expectations.
  5. Enable the connector for the wider workspace.
  6. Review access and usage on a regular schedule.

🔌 How to Revoke Access

To stop the connector from working for a user, disconnect it in your Claude workspace settings. You can also remove the user's access or change their role in Search Atlas. For offboarding, do both. If you need a company-wide shutoff, disable the connector at the workspace level.

💬 Getting Written Confirmation

For a formal review, tell our team which items you need, such as the attestation reports, OAuth specifics, the DPA, the subprocessor list, and billing details. Include your company name and your security questionnaire if you have one.

If you need further assistance, open the chat widget in the bottom-right corner of the platform and type human teammate to be instantly connected with a member of our team.