Security & compliance
Strict institutional posture
Trinity Insights MCP Server applies an institutional security posture: mandatory Bearer authentication, HTTPS-only transport with HSTS preload, tier-aware rate limiting, anonymized logging. No end-user personal information is stored on the MCP side - only the API key hash and aggregated usage metrics.
Authentication
Each MCP request must present a header Authorization: Bearer YOUR_TRINITY_API_KEY. Keys are generated via Dashboard → Settings → MCP API Keys, with a scope dedicated to MCP (separate from your web Clerk session).
- Keys stored hashed (HMAC-SHA256 with server-side pepper). The plaintext key is shown only once on creation.
- Immediate revocation via the dashboard. A revoked key stops working within 60 seconds (cache TTL).
- Migration to OAuth 2.1 PKCE with Resource Indicators (RFC 8707) planned for phase 2, in line with the Anthropic Connectors Directory roadmap.
Transport
- Strict HTTPS : TLS 1.3 required, valid Cloudflare certificates. Any HTTP request is 308-redirected to HTTPS.
- HSTS preload : header
max-age=31536000; includeSubDomains; preloadon all subdomains, includingmcp.trinityinsights.io. - Streamable HTTP : MCP transport compliant with the 2025-11-25 specification, supporting long requests and server-sent events streaming when the client requests it.
- Cloudflare WAF : custom rules filter malicious requests. Verified AI crawlers (cf.client.bot=true) are allowed to browse documentation pages.
Tier-aware rate limiting
Trinity MCP applies a per-API-key token bucket rate limit calibrated on your dashboard tier. The tier is resolved dynamically on each call - a dashboard upgrade propagates to the MCP within 60 seconds.
| Tier | Per-minute quota | Burst behavior |
|---|---|---|
| Visitor (unauthenticated) | Minimal exploration quota | Read-only documentation access |
| Free | Standard quota | Limited burst for occasional usage |
| Founding / Pro | Sustained quota | Comfortable burst for regular usage |
| Performance | Institutional quota | Wide burst for intensive usage |
| Team | Performance × seats | Managed multi-user |
Precise quotas are published in the private API documentation accessible once authenticated. Any request exceeding the quota receives an HTTP 429 error with the retry delay.
Logging and privacy
- No personal data transmitted by the MCP client is stored on the server side. The user prompt transits to the tools but is never persisted.
- Aggregated metrics : anonymized counters per tier, per tool, per day. For capacity audit and pricing, never for individual profiling.
- API key hash : only the HMAC-SHA256 hash of the key is stored. The plaintext key is never persisted.
- Retention : application logs and metrics retained per the privacy policy (/legal/privacy). No data sale, no advertising tracking.
MiCA / AMF compliance
Trinity Insights is a Bitcoin on-chain and macro-intelligence analytical tool for educational purposes. It provides no investment advice or personalized recommendation.
- Non-CIF : not a Financial Investment Advisor within the meaning of articles L.541-1 et seq. of the French Monetary and Financial Code.
- Non-PSAN : not a Digital Asset Services Provider registered or approved by the AMF (French financial markets authority).
- Non-CASP : not a Crypto-Asset Service Provider under MiCA Regulation (EU) 2023/1114. Trinity performs none of the MiCA-regulated services (custody, exchange, broking, advice, portfolio management, etc.).
See the detailed regulatory status on /legal/mica-status.
Intellectual property protection
Trinity proprietary indicators are multi-factor models. The bounded 0-100 score and its atemporal interpretation structure subscriber usage.
The tool get_trinity_composite returns the score and the atemporal interpretive zone (Accumulation / Neutral / Distribution / Euphoria), along with tier metadata and the compliance disclaimer.
Vulnerability reporting
To responsibly report a vulnerability, contact [email protected] with a detailed description, a reproducible proof of concept and your identity (optional for hall of fame). Valid reports are handled within 7 days. Trinity Insights does not at present reward reports in crypto-assets; a public credit may be granted on request.
Statut réglementaire et avis légal
Trinity Insights est un outil d'analyse on-chain Bitcoin et de macro-intelligence à vocation éducative et informationnelle. Les contenus diffusés ne constituent pas un conseil en investissement, une recommandation personnalisée, ni une incitation à acheter ou vendre un actif. Trinity Insights n'est pas conseiller en investissements financiers (CIF) au sens du Code monétaire et financier, n'est pas un prestataire de services sur actifs numériques (PSAN) enregistré ou agréé par l'AMF, et n'est pas un Crypto-Asset Service Provider (CASP) au titre du Règlement MiCA (UE) 2023/1114. Investir dans les crypto-actifs comporte un risque de perte en capital, qui peut être totale. Les performances passées ne préjugent pas des performances futures. Trinity Insights ne garantit pas l'exactitude, l'exhaustivité ou la pertinence des données présentées. Faites toujours vos propres recherches avant toute décision.