What a connected assistant can do
- Read your monitored domains, scan results and history.
- Run scans, add domains to monitoring and create report links.
- Audit other sites with your audit credits — only after asking you, every time.
What it can't do
- See or change billing, payment details, your password or account settings.
- Buy anything — plans and credits are bought only on bannerproof.app through Paddle.
- Read other accounts' data.
How it's protected
- Sign-in (OAuth with PKCE): the assistant never sees your password. It gets an access token valid for one hour and a refresh token that changes every time it's used; reusing an old one cuts the connection off.
- API tokens are long random keys, stored only as hashes. Regenerate or revoke yours in Settings at any time.
- Scan results never contain the content of the scanned websites — only tracker names and request addresses — so a website can't slip instructions to your assistant.
- Scans can only target public websites.
Disconnecting
- Signed-in assistants (claude.ai, ChatGPT, Claude Code with sign-in): open Settings → Connected assistants and click Disconnect, or remove the connector in the assistant. Access stops immediately.
- API token connections (Cursor, Claude Code with a token): revoke or regenerate the token in Settings → API token. Every tool using the old token stops working.
Troubleshooting
"This needs a connected Bannerproof account." You're on the free address (/mcp/free) or not signed in. Connect https://api.bannerproof.app/mcp and sign in, or add your API token.
"The API token is invalid or was revoked." Generate a new token in Settings and update your client's configuration.
"Too many invalid tokens from this connection." Several wrong tokens were tried from your network. Wait 15 minutes and use the correct token.
"Not started: auditing a site spends 1 audit credit." That's the safety check — confirm in the chat that the assistant may use a credit.
"A manual scan can run again in about N minutes." Fresh scans of a monitored domain are limited to one every 15 minutes. get_findings shows the latest result meanwhile.
The sign-in page says the request expired. The connection request is valid for 15 minutes. Start the connection again from your assistant.
The assistant doesn't use Bannerproof. Make sure the connector is enabled for the chat, or mention it: "Use Bannerproof to check …".
Still stuck? Contact us with the name of your assistant and the error message.