The SocialCRM MCP App exposes an authorized Brand Snapshot inside ChatGPT. The snapshot contains repository assets, stored provider checks, and recorded metrics available to the authorized account. It does not imply continuous consumer-surface monitoring or external mention collection.
What You Can Do in ChatGPT
- Request a Brand Snapshot. One request returns the authorized brand context and stored evidence available at request time.
- Share results back to the model. We can inject the snapshot into model context for better follow-up responses.
- Stay in the conversation. The response includes record timestamps so you can judge freshness.
How We Secure It (Clear + Strict)
- 1) API keys from your dashboard. We use the keys you already manage in
/settings/api-keys—no extra provisioning. - 2) Auth on every call. MCP tool calls require
Authorization: Bearer <key>. Missing or invalid keys are rejected. - 3) Company scoping enforced server-side. We derive
companyIdfrom the key and force it into brand-scoped tools. Clients can’t spoof it. - 4) Tool allowlist only. The MCP App exposes a vetted, read-only snapshot surface—no destructive actions.
- 5) Locked iframe origin. The UI only embeds from the approved ChatGPT host.
If You Want It Even Tighter
We can lock this down further in hours, not weeks:
- Per-key rate limits to prevent abuse and enforce fair usage.
- Scoped permissions so each key only accesses the specific tools you allow.
- Brand allowlists so a key can only access designated brand IDs.
If you want to run Brand Snapshots in ChatGPT securely, we’re ready. This is the baseline—and we can harden it as far as you need.
MCP Apps are the new integration surface for AI workflows. We’re excited because it finally matches how teams work: conversation-first, data-rich, and secure by default.