What it accesses

The Entra app asks for delegated permissions only, all acting as the signed-in user: User.Read (sign-in), Workspace.Read.All and Item.Read.All (listing sources, reading metadata), GraphQLApi.ReadWrite.All (creating or updating the one item you ask for; it never deletes), GraphQLApi.Execute.All (your read-only queries) and Azure SQL user_impersonation (table and column names from the SQL analytics endpoint, and the checks and samples you ask for). The tools that create semantic models, ontologies, data agents, notebooks and pipelines need more (Item.ReadWrite.All or a narrower permission per item type), which the hosted app does not ask for today; they are marked Available when enabled by the operator below.

The data path. Planning uses schema metadata: workspace, item, table and column names and types. validate_plan and suggest_relationships check keys and references against the rows in Fabric with counting queries and return only the counts. sample_rows returns up to 20 example rows of one table, and query_graphql returns the results you ask for. describe_backend, plan_drift, app_starter and lineage read the definitions of items in the workspace. Metadata, requested samples and query results pass through Krusgraph on their way to your MCP client and are not kept after the request. From Claude, your tokens are exchanged on your behalf and held in memory only, never written to disk or logs. From an MCP client other than Claude (signing in through krusgraph.com/oauth), the Microsoft tokens of a sign-in are kept encrypted in an Azure Table Storage table of ours in the service's Azure region until your client collects them (at most 60 seconds), and Microsoft's refresh token stays there encrypted for as long as your client keeps renewing its access, at most 90 days, and is never given to the client; after each renewal the answer given (an access token and the next refresh token) is kept there encrypted too, used for at most 60 seconds to answer the client again if it asks again (sign-in from MCP clients other than Claude); apart from those sign-in records there is no database and no file storage. Each tool call leaves an anonymous usage record (the tool, how the call ended, how long it took), and the service writes technical logs. Details: privacy policy.

Personal data and sensitivity labels. Columns whose name looks like personal data are flagged by one rule per pattern, from the name alone and never from the values: a person's name (P1: first_name, last_name, and name in a table that holds people such as customers or employees), e-mail (P2), telephone (P3), national identity number (P4, such as personnummer), address (P5: street, postal code, and the city in a table of addresses or people) and birth date (P6). By default sample_rows returns their values as *** with a notice naming the rule, answer_query_draft and gold_views_draft leave them out (the key stands in), and the silver notebook masks them in its quarantine table; show_personal_data=true shows them, and your own Fabric permissions still decide what you can read. When Fabric returns a Microsoft Purview sensitivity label on the source item, sample_rows and validate_plan name it: Fabric gives the label's id only, and a label covers the whole item, so the column rules still decide what is masked.