Appian MCP Server Security

On This Page

This page is for system administrators, security teams, and compliance reviewers. It describes how Appian MCP Server enforces security across authentication, object access, data queries, and audit logging.

Authentication methods

Appian MCP Server supports two ways to authenticate Model Context Protocol (MCP) connections. The authenticated identity determines which tools are visible and what data is accessible.

OAuth 2.0 authentication

OAuth 2.0 authenticates each MCP connection as the signed-in Appian user. A user authorizes an authorization code client through Appian's sign-in page, and Appian issues an access token scoped to that user. MCP requests then run with that user's permissions, and each user's identity is preserved.

Service account authentication

Service account authentication uses an API key to authenticate all MCP connections under a single Appian service account. The service account's permissions and group membership determine tool visibility and data access for all connected AI applications. Because every connection shares one identity, service account authentication does not preserve which user initiated a request.

Supported methods: Native authentication, SAML authentication.
Credential format: API key generated in the Admin Console.
Credential distribution: System administrators generate the API key and distribute it to authorized users.

Object security

Appian MCP Server respects object security for all Model Context Protocol (MCP)-enabled design objects. The service account must have the appropriate permission level for each design object type for it to appear as an available MCP tool.

Object security enforcement applies to:

AI agents: The service account must have permission to view the AI agent and all of its underlying tools.
Expression rules: The service account must have Viewer permission to the expression rule.
Business processes: The service account must have Viewer permission for the business process and process artifacts.
Process models: The service account must have Initiator permission to the process model.
Record types: The service account must have Viewer permission to the record type.

If the service account lacks the required permissions, the MCP tool does not appear in search results. The tool is invisible to the AI application—it cannot be discovered or invoked.

Record-level security

Appian MCP Server enforces record-level security on all data fabric queries made through Model Context Protocol (MCP). External AI applications querying record data are subject to the same record-level security rules as users querying data within Appian.

Record-level security enforcement means:

Row filtering: Query results only include records the authenticated user has access to.
Consistent behavior: The same security rules apply whether data is accessed through an Appian interface, a Web API, or MCP.

Security expressions limitation

Record types with record-level security expressions are not accessible through the data fabric tools. These record types do not appear in metadata responses and cannot be queried.

Replace the security expression with security rules to make the record data accessible from Appian MCP Server.

Field-level security

Appian MCP Server enforces field-level security on all data fabric queries made through Model Context Protocol (MCP). Fields hidden by field-level security are excluded from query results and schema responses.

Field-level security enforcement means:

Hidden fields excluded: Fields the authenticated user cannot see are not returned in query results.
Schema filtering: The appian_data_fabric_metadata tool only returns field definitions for fields the user can access.
Consistent behavior: The same field-level security rules apply whether data is accessed through an Appian interface or MCP.

Group membership

Appian MCP Server filters tool visibility by the authenticated user's group membership. Model Context Protocol (MCP) tools associated with specific groups are only visible to members of those groups.

Group membership enforcement means:

Tool discovery filtered: The appian_search_tools system tool only returns tools accessible to the authenticated user based on group membership.
AI agent role maps enforced: AI agents made available through MCP require the authenticated user to be on the role map for the agent and all underlying tools.

Audit trail

Appian MCP Server requests are recorded in the Platform API trace log (appian_platform_api_trace.csv) when you enable Platform API trace logging in the Admin Console. By default, Platform API trace logging is disabled.

Each log entry includes the following information:

Username: The service account or user that made the request.
Endpoint: The platform API endpoint called (for example, /design-objects/record-types/query/sql).
Timestamp: When the request was received.
Status and error code: Whether the request succeeded, and the Appian error code on failure.

For the full monitoring reference, see Monitor Appian MCP Server.

Data in transit

All Model Context Protocol (MCP) connections use HTTPS encryption. Data transmitted between the AI application and Appian MCP Server is encrypted in transit using the same TLS standards as other Appian platform connections.

Comparison with web API security

Appian MCP Server and web APIs use the same underlying security model with different invocation paths. Model Context Protocol (MCP) is designed for AI applications that discover and select tools, while web APIs are designed for system-to-system integrations:

Security layer	Web APIs	Appian MCP Server
Authentication	API key, OAuth 2.0 Client Credentials, OAuth 2.0 Authorization Code, mutual TLS, SAML	OAuth 2.0 Authorization Code, service account API key
Object security	Enforced per Web API object	Enforced per MCP-enabled design object
Record-level security	Enforced on data queries	Enforced on all data fabric MCP queries
Field-level security	Enforced on response data	Enforced on response data
Group membership	Enforced per Web API	Enforced on tool visibility
Audit logging	Logged per API call	Logged per MCP tool call

The security model is the same—the difference is the invocation path. Web APIs are designed for system-to-system integrations where the calling system knows which endpoint to call. MCP is designed for AI applications that discover and select tools based on natural language requests.

Feedback

Was this page helpful?