Overview

The reviews.ai MCP server lets any MCP-compatible AI client (e.g. Claude, ChatGPT) query a reviews.ai account's review data in plain English. It is built, owned, and operated by Reviews.ai as a first-party service: the MCP server, the API behind it, and the data store are all part of the reviews.ai platform, with no third-party service in the request path. (how to connect it)

Item	Value
Endpoint	`https://app.reviews.ai/api/mcp`
Protocol	Model Context Protocol (JSON-RPC 2.0), spec version 2025-03-26
Transport	Streamable HTTP over TLS
Authentication	OAuth 2.1 with PKCE
Access level	Read-only (all tools)

Architecture

The client sends tool calls over HTTPS; the MCP server validates the OAuth token on every request, then answers through the same first-party API and data store that power the reviews.ai dashboard. Requests are stateless, and conversation content never reaches the server.

Authentication

Connections are authorized with OAuth 2.1. No reviews.ai credential is ever typed into, stored in, or visible to the MCP client or the model.

Flow: OAuth 2.1 authorization code with PKCE (S256 required).
Client registration: Dynamic Client Registration (RFC 7591), so any compatible client (Claude, ChatGPT, and others) registers automatically.
Discovery: standard metadata at /.well-known/oauth-authorization-server (RFC 8414) and /.well-known/oauth-protected-resource (RFC 9728).
Account linking: during consent, the user pastes their reviews.ai API token once on the reviews.ai authorization page. The token is validated, encrypted at rest, and stored server-side only. It is never shared with the MCP client.
Revocation: removing the connector in the client or revoking access from the reviews.ai dashboard invalidates the connection's tokens immediately.

Authorization and access scope

Every connection is bound to exactly one reviews.ai account: the account whose API token was linked during consent. The OAuth token presented on each request is the identity, and every query is scoped server-side to that account's data. There is no cross-account access path.

Account scoping is enforced on the server for every tool call; the client cannot widen it.
Brand scoping (optional): a connection can be restricted to named brands within an account. The server injects the brand scope when a request names none, intersects it when a request names brands, and refuses out-of-scope requests with a named error rather than returning partial data.
Multiple accounts: an organization can run several connections side by side (one per reviews.ai account); each carries only its own account's scope.

Permissions: read-only

The connector requires read-only access, and read-only is all that exists: there is no write mode to request, grant, or misconfigure.

Every tool is annotated readOnlyHint: true per the MCP specification, so clients can verify the access level from the tool definitions themselves.
- The OAuth layer enforces the same thing: read is the only scope the authorization server supports (visible in its public discovery metadata), so a write permission cannot even be requested.
No tool, and no underlying API endpoint the connector uses, can create, modify, or delete anything in the connected account.
The one side effect: the CSV export tool generates a point-in-time snapshot file and returns a time-limited download link. This writes nothing to the account and changes no data.

Capabilities

The server exposes seven tools, all read-only. They share one filter vocabulary: product ids, brands, category, tag, review source, star-rating range, topic, and a date window.

Tool	What it returns
get_products	The monitored products, locations, and apps, with lifetime rating and review totals
get_sentiment_summary	Exact aggregates for any filtered set and date window: review count, average rating, star distribution, NPS, top positive/negative topics, per-product stats, and the valid filter values (facets)
get_topics	The topic taxonomy with positive and negative counts for a filtered set
get_ratings	Daily rating trends per review source
get_reviews	Individual review text and metadata, filtered and paginated
get_extracts	Per-review AI-extracted insights: strengths, weaknesses, opportunities, threats, emotion, per-topic mentions, and segment extracts (who, what, when, why, how)
export_reviews	A CSV export of any filtered review set, returned as a time-limited download link

Security controls

Transport: all traffic runs over HTTPS/TLS; there are no plaintext endpoints.
Credential storage: OAuth access and refresh tokens are stored hashed; the linked reviews.ai API token is encrypted at rest. Plaintext credentials are never written to disk or logs.
Rate limiting: every request is rate limited per connection.
Audit logging: requests are logged (tool, parameters, timestamp, connection) for auditing. Logs cannot contain conversation content because the server never receives it.
Minimal data exchange: the server receives only tool names and parameters from the client, never chat text. Responses are paginated and capped, with explicit count/returned/truncated fields so partial results are always declared.
CSV exports: served from unguessable tokenized URLs that act as the access control; export files are purged within 24 hours.

Data handling, privacy, and revocation

The connector processes the data already in the connected reviews.ai account: review content collected from public review platforms, product and location metadata, and aggregates computed from them.

No conversation data: the MCP server never receives the conversation itself. No messages, prompts, or chat history reach it; it sees only tool names and structured filter parameters (ids, brands, topics, dates), which the AI client composes and which may echo short terms from the user's request. Those parameters are logged; chat content is not, because it is never received.
No personal health data is collected or processed.
Data use: reviews.ai does not sell customer data and does not use it to train models. Once results are returned into a chat, they become part of the user's conversation with their AI provider; whether that conversation is used for model training is governed by the user's own settings and agreement with that provider (for example, Claude or ChatGPT data controls), not by reviews.ai.
Retention: export files are purged within 24 hours; access tokens expire after 1 hour and refresh tokens after 30 days.
Revocation: disconnect in the MCP client (in Claude: Settings > Connectors > reviews.ai > Remove; in ChatGPT: Plugins > select Reviews.ai > Manage > Uninstall; other MCP clients have an equivalent) or revoke access from the reviews.ai dashboard. Either path invalidates the connection's tokens immediately.

MCP Connector: Technical & Security