Privacy & Data Handling

OneLens MCP · Last updated 1 July 2026

The OneLens MCP server (https://mcp.onelens.cloud/mcp) lets an AI assistant query your OneLens cloud-cost data on your behalf. This document describes what it accesses, what it stores, and how access is controlled. It supplements — and defers to — your primary OneLens agreement and privacy policy.

What it is

A stateless, read-only proxy between an MCP-compatible AI host (Claude, Cursor, etc.) and the OneLens cost-analytics API. It exposes query tools only — it cannot create, modify, or delete anything in your OneLens account or cloud providers.

Data it accesses

• Cost analytics for your organization: cost sources, dimensions and their values, aggregated/grouped cost figures, and time-series — the same data you see in the OneLens app, scoped to your organization only.
• It does not access cloud credentials, resource contents, or any data outside OneLens cost analytics.

Authentication & authorization

• Sign-in uses OneLens (PropelAuth) OAuth 2.1 with PKCE and Dynamic Client Registration. You authenticate in your browser; the assistant never sees your password.
• Every request is authorized per-user and scoped to your org. Entitlement, denylist, and rate-limit checks run on each call. Access can be revoked instantly by your OneLens admin.

What it stores

The server keeps no durable copy of your cost data. Transient state only:

• Short-lived response cache (~5 minutes) and source-configuration cache (~1 hour), in an in-cluster Valkey store, keyed by organization. Speeds up repeat queries; expires automatically.
• Operational counters (rate limit / quota / circuit-breaker) — no cost data.
• Structured request logs for reliability and debugging: user email, org id, tool name, request id, and the query parameters (source, time range, group-by, filters). Cost values are never logged. Response bodies are logged only on error, never on success.

Sub-processors / infrastructure

• Google Cloud (GKE, asia-south1) — hosting.
• Cloudflare — TLS termination and edge protection.
• PropelAuth — authentication / token issuance.

Cost data is served from OneLens' existing production infrastructure; the MCP server adds no new long-term data store.

Retention

Caches expire on their TTLs (minutes to an hour). Operational logs follow the standard OneLens retention policy. No cost figures are persisted by this service.

Your controls

• Disconnect the connector in your AI host at any time.
• Ask your OneLens admin to revoke MCP access for your org or user.

Contact

Questions or requests: support@astuto.ai. Each request carries a trace id we can use to investigate a specific interaction.