MCP security & data

Last updated: August 2026

DocStash is a remote MCP server (Streamable HTTP over HTTPS) that lets your AI assistant create, save, and share documents in your DocStash account. This page describes exactly how it authenticates, what its tools can do, and how your data is handled.

Endpoint:https://mcp.docstash.ai

Authentication

Every connection is secured with the MCP OAuth 2.1 standard: server metadata discovery (RFC 8414) and Dynamic Client Registration (RFC 7591). Your MCP client runs the sign-in in your browser, so the server never sees your Google or SSO password. Tokens are user-scoped and revocable at any time from your DocStash settings or your client. A token only ever acts as you, on your own account.

What the tools can do

The server exposes a fixed, published set of tools. Every one operates only on content in your own DocStash account. There is no filesystem access, and no access to anything outside DocStash. The live schema is discoverable by any client via the standard MCP tools/list handshake at the endpoint above.

Create

Author a new document of the given type.

create_pagecreate_appcreate_pdfcreate_docxcreate_sheetcreate_text

Render

Render an existing document and show it to you as a live preview. The content is not read into the assistant.

get_pageget_pdfget_docxget_sheetget_text

Read

Read a document's content into the assistant's context, and list your documents.

read_documentlist_documents

Screenshot

Render a screenshot image of one of your documents.

screenshot_document

Save & manage

Save a preview as a document, trash or restore it, and control who it is shared with.

stashdiscardmanage_documentmanage_sharing

Account

Read your organizations and members, and switch the active organization.

get_organizationsset_organizationlist_org_members

Data handling

What is stored

The documents you create through the tools (their content and version history), plus minimal account and session metadata needed to run the service.

Private by default

Documents are private to you unless you explicitly make one public or grant someone access.

Retention

Documents persist until you trash and then permanently delete them.

No model training

Your content is never used to train AI models. DocStash stores and serves what you make, nothing more.

Full details

The complete data practices live in our Privacy & Terms.