Security & Privacy
How the 3D AI Studio MCP connector protects your account: OAuth sign-in without API keys, exact permissions, spending safeguards, your data and revoking access.
Connecting an assistant gives it limited, revocable access to your 3D AI Studio account. This page explains in plain language what that access includes, what it does not, and how to stay in control.
How the connection is secured
- You sign in on 3D AI Studio, not in the assistant. The sign in page belongs to 3D AI Studio. Your assistant never sees your password, passkey or one time codes.
- No API key. Access uses the industry standard OAuth sign in. Nothing secret is created for you to copy, paste or store in a configuration file, so there is nothing that can leak from a file or a repository.
- You approve every connection. Each assistant shows up on its own sign in page with its name, and access is only granted after you click Authorize.
- Encrypted connection. All traffic between your assistant and 3D AI Studio uses HTTPS.
- Revocable at any time. You can disconnect any assistant instantly. See Managing Connections.
Only authorize connections you started yourself. The sign in page shows the name of the app asking for access and, where available, its web address. If you did not just connect an assistant, or the name or address looks wrong, click Cancel.
The permissions an assistant gets
The sign in page lists these under "This app will be able to":
| Permission | What it allows |
|---|---|
| Generate 3D models using your credits | Start 3D generations and 3D processing (low poly, UV unwrap, format conversion) |
| Generate and edit images using your credits | Generate and edit images, create materials, remove backgrounds, and receive the images you upload |
| View your generations and projects | Browse your library, check the status of generations, and show results |
| Create projects and organize your generations | Create dashboard projects and move generations into them |
| View your credit balance | Read your balance and the model price list |
Spending always comes from the credit source you chose when connecting: your personal credits or one team you belong to.
What an assistant can never do
- See or change your password, passkeys, email address or other account settings.
- See your payment details, or change your plan, billing or subscription.
- Delete your models, images or projects.
- Make your models public or share them.
- Invite or remove team members, or change team settings.
- Spend credits from a credit source you did not choose.
Safeguards for your credits
- Assistants only generate when you ask. Every generation costs the same as on the website, and failed generations are refunded automatically.
- Unusually expensive requests need your confirmation before any credits are spent.
- Settings → AI Assistants (MCP) shows how many actions each assistant has run and how many credits it has spent.
- For shared or automated agents, connect them to a team with a limited credit balance, so they can never spend more than you put there.
More details are on Credits & Limits.
Your data
- Your generations stay private. Models and images created through an assistant are saved to your dashboard with the same privacy as everything you create on the website. They are not published, and they are not used for training.
- Uploads are only for you. Images you upload through the connector belong to your account, are only used for the generations you request, and are removed after 24 hours. Results you create from them stay in your dashboard.
- What your assistant's provider sees. The assistant you use (for example Claude by Anthropic or ChatGPT by OpenAI) sees your conversation, including what 3D AI Studio sends back to it, such as the status of a generation, result links and previews. That part is covered by your assistant provider's own privacy terms.
Good habits
- Review your connections now and then. Disconnect assistants you no longer use.
- Never paste credentials into a chat or configuration file. The connector never needs a password, token or API key. If an agent or a setup guide asks for one, it is not following the official setup.
- Use the official address only. The connector URL is
https://mcp.3daistudio.com/mcp. Do not connect to look alike addresses. - If something looks wrong, disconnect the assistant, use Sign out of all devices in Settings → Security (this also disconnects every assistant), and contact us.
Reporting a security issue
If you believe you found a security problem with the connector, email support@3daistudio.com with the subject "Security". Please do not post details publicly before we have had a chance to look at it.
Frequently Asked Questions
Yes. The assistant gets only the permissions listed above, never your password, and you can disconnect it instantly. The main thing to watch is spending, which you can control with the safeguards above.
It can see your 3D AI Studio library and projects so it can work with your models. It cannot access anything outside your 3D AI Studio account through the connector.
Only someone with access to your assistant account or your computer's assistant session. Protect those like any other account. If you suspect misuse, disconnect the assistant and sign out of all devices.
No. 3D AI Studio only receives the requests the assistant sends to the connector, such as "generate a 3D model with this prompt". It does not receive the rest of your conversation.