Skip to main content

Security And Troubleshooting

Optimus MCP lets an AI assistant access VAT lookup and validation. Configure it with the same care you use for API access to production customer data.

Authentication​

Use OAuth when your MCP client supports MCP OAuth discovery. OAuth-capable clients discover Optimus authorization metadata from the MCP endpoint, register dynamically, and redirect the user to Optimus for sign-in and consent.

Use Personal Access Tokens only as a fallback for clients that cannot use OAuth but can send custom authorization headers.

Protect API Tokens​

  • Create Personal Access Tokens in the Optimus web app under Settings > API Interface > API Tokens only when your MCP client needs bearer-token fallback.
  • Store tokens in your MCP client's secure configuration or secret store.
  • Do not paste real tok_optimus_ token values into chat messages, prompts, screenshots, tickets, generated files, or logs.
  • Revoke or rotate a token in Optimus if it may have been exposed.

Bearer-token fallback clients must send:

Authorization: Bearer <token>

Hosted Endpoint​

The hosted Optimus MCP endpoint is:

https://mcp.app.optimussoftware.de

If your MCP client supports action allow-lists, enable only Optimus VAT lookup and validation actions for this connection.

Customer Data​

VAT IDs, company names, addresses, customer numbers, supplier numbers, validation results, and PDF metadata can be sensitive customer data.

Use these rules:

  • Share only the records needed for the task.
  • Avoid asking the assistant to print complete customer lists unless necessary.
  • Ask for summarized results when full details are not needed.
  • Do not include tokens in the same prompt as customer data.

Safe Retry Behavior​

For important validation jobs, ask the assistant to use a stable reference for retries, such as your import job ID or batch ID.

Example:

Use Optimus MCP to validate this supplier batch. Use customer-import-2026-05-22-001 as the retry reference.

This helps Optimus avoid duplicate work if the assistant retries after a timeout or network interruption.

Common Problems​

ProblemWhat to check
The assistant cannot connect to Optimus MCP.Confirm the endpoint URL is exactly https://mcp.app.optimussoftware.de.
OAuth sign-in does not start.Confirm the client is configured with the MCP endpoint URL, not the Hydra or Optimus web app URL. Remove and re-add the connector if the client cached old metadata.
OAuth consent shows an unexpected client or redirect URI.Cancel the flow and re-add the connector from the MCP client you trust.
The assistant reports missing authorization with a token-based setup.Confirm the MCP client sends Authorization: Bearer <token>.
The token is rejected.Confirm the token was copied correctly and has not been revoked.
A VAT lookup cannot find a match.Include company name, country, street, ZIP, and city when available.
A validation takes longer than expected.Ask the assistant to continue the validation and summarize the final result.
A validation failed.Keep the operation or batch reference and contact Optimus support with the error message.

What To Share With Support​

When you need help, share:

  • The endpoint you used.
  • The time of the failed request.
  • The VAT ID or your own non-sensitive reference ID.
  • The assistant's error message.

Do not share real bearer tokens.