Skip to main content

BPP MCP Server

The BPP MCP Server exposes your BPP workspace to AI agents through the Model Context Protocol (MCP) — an open standard that lets AI assistants like Claude and ChatGPT securely call tools provided by external systems. Any MCP-compatible client can list your tables, query your data, inspect audiences and signals, and create drafts, using the same operations that power the in-product Copilot.

Endpoint​

The server speaks MCP Streamable HTTP. The endpoint is:

<server URL>/mcp

The exact server URL for your installation is shown in BPP under AI Copilot → MCP Server, alongside your credentials.

Authentication​

External clients authenticate with a personal MCP credential — a token starting with bppmcp_, sent as a Bearer token on every request:

Authorization: Bearer bppmcp_xxxxxxxxxxxxxxxx

Credential semantics:

  • Acts on your behalf — every call made with the token is attributed to the user who created it and scoped to that user's customer workspace. Cross-workspace access is impossible.
  • Shown once — the plaintext token is displayed only at creation (or rotation). BPP stores only a hash; if you lose the token, rotate the credential to get a new one.
  • Scoped — the token grants a fixed subset of tools (see Tool scope below).

:::warning Treat tokens as secrets An MCP token gives read access to your customer data. Don't commit it to repositories, share it in chats, or embed it in client-side code. If you suspect a token has been exposed, rotate or revoke it immediately from the MCP Server tab. :::

Managing credentials​

Credentials are managed in AI Copilot → MCP Server. You need the MCP Credential Manager permission group to see this tab.

ActionEffect
GenerateCreates a new credential (with an optional label, e.g. "Claude Desktop — Marco"). The token is shown once, together with ready-to-paste configuration snippets for common clients.
RotateIssues a new token for the credential and immediately invalidates the old one. Use this after a suspected exposure or on a regular rotation schedule.
RevokePermanently disables the credential. Clients using it start receiving authentication errors.
DeleteRemoves a revoked credential from the list.

Create one credential per client or teammate rather than sharing a single token — labels make it easy to see what each one is for, and you can revoke them independently.

Tool scope​

External credentials do not get the full tool set. By default they can use:

  • All read tools — listing and inspecting audiences, signals, connections, destinations, tables, fields, identity-graph statistics, and AI model instances, plus data-quality checks, signal previews, formula validation, and read-only BigQuery queries.
  • Draft creation — create_audience and create_signal only. Drafts must be reviewed, connected to destinations, and activated in the BPP UI.

Everything else — updating, cloning and running entities, binding destinations, creating or deleting AI model instances, editing field metadata — is reserved to the in-product Copilot, where each action goes through human-in-the-loop approval.

Tools outside a credential's scope are not just blocked — they are hidden from tool discovery, so external agents don't even see them. The full matrix is in the MCP Tool Reference.

Query safety and rate limits​

  • query_bigquery accepts read-only statements (SELECT/WITH) against your own datasets, with hard caps on bytes scanned and execution time.
  • Requests are subject to per-user and per-IP rate limits; a burst of calls beyond the limit receives an error and should be retried later.
  • On-demand runs triggered through MCP (Copilot only) share the same per-customer daily cooldown as the UI.
Last updated on