Note: The ObservePoint MCP server has not been made generally available yet, but it is coming soon.
What is ObservePoint?
ObservePoint is a website governance and monitoring platform. Companies use it to check that their own public websites are behaving the way they're supposed to: that analytics tags are firing correctly, cookies and tracking scripts match what's disclosed in the privacy policy, consent banners actually block tracking when a visitor opts out, and pages meet accessibility standards.
ObservePoint periodically visits a company's own website, the same way a regular visitor's browser would, and reports back on what it finds. ObservePoint is not an advertising, analytics, or data broker; ObservePoint does not collect or sell data about your users. It's a diagnostic tool your organization points at your own site.
What data does ObservePoint have from your company?
Audit and scan results
These are the findings from the checks your organization has configured: which tags and cookies show up on which pages, screenshots of those pages, accessibility issues found, and consent or compliance behavior. This data comes from your website's publicly accessible pages, the same pages any visitor's browser (or a search engine crawler) could load. If your organization has set up a specific authenticated flow to be scanned, such as a checkout process using a test account, ObservePoint's visibility is limited to exactly that scripted flow.
Account configuration
This is information about how your organization uses ObservePoint itself. For example, which audits exist, which rules are set up, who has a login.
ObservePoint does not have customer or end-user personal data.
What is an MCP server, and how does it work?
MCP, short for Model Context Protocol, is an open standard which defines how an AI assistant (like Microsoft Copilot, Claude, or ChatGPT) can call out to an external service to fetch information or take an action, instead of a person typing that request into the service's own website by hand.
An MCP server only exposes a fixed set of predefined actions, called “tools”, like “get last night's audit results” or “list active audits.” The AI assistant can only call those specific tools; it has no general access to ObservePoint's systems and can't run arbitrary queries or reach anything outside that defined list
The MCP server’s actions are still enforced by ObservePoint's account permissions and login, the same system that governs access to the regular ObservePoint website and API today.
How do the ObservePoint API, the MCP server, and your LLM work together?
Five things happen in sequence, and the important part is where ObservePoint's side of that sequence ends and your organization's AI vendor relationship begins.
ObservePoint's audit engine crawls or scripts your website, exactly as it does today. No AI model is involved at this stage.
Results get stored in ObservePoint's own database, the same backend that powers the ObservePoint web app and existing API integrations.
The MCP server sits in front of that same API. It authenticates the request as a specific logged-in user through OAuth 2.1 and routes it to the right tool. Each tool is hosted on the ObservePoint platform, so there are no new vendors or 3rd parties involved. Each tool invokes the ObservePoint API, and the ObservePoint API enforces the same permissions that user already has.
The requested data gets handed to your organization's chosen AI model. ObservePoint doesn't select, host, or operate that model. It's whatever your organization has already approved and connected.
That model produces the answer, and the user sees it.
The first three steps, your website, the audit engine, and ObservePoint's API and database, sit entirely inside ObservePoint's existing security and access controls. The fourth step, the AI model, sits outside that boundary: it's governed by your organization's agreement with whichever AI provider you've connected. Their data handling terms, retention policy, and DPA apply from that point forward, not ObservePoint's.
What new risk does the MCP server create?
Short answer: none, beyond what's already true of your existing ObservePoint access.
The MCP server doesn't grant any new access. Every request it handles is authenticated as a specific ObservePoint user, through the same login and role-based permissions that user already has. If someone on your team can already see an audit's results, create a new audit, or delete old audit information by logging into ObservePoint, they can ask their AI assistant to do the same thing through the MCP server.