--- title: KentiCopilot security related: - https://docs.kentico.com/guides/development/kenticopilot.md - https://docs.kentico.com/guides/development/kenticopilot/work-effectively-with-kenticopilot.md --- > Agent instructions: > **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown. > > - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version. > - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt). [KentiCopilot](https://docs.kentico.com/guides/development/kenticopilot.md) connects your AI tool to Xperience by Kentico. This page describes where the resulting project data travels, what each component records and retains, and which controls you configure yourself. > **Note:** This page covers _KentiCopilot_, which is a suite of **development** tools. It does not cover AIRA, the AI capability built into the administration interface for business users. AIRA processes production content and has its own data-protection statement, see [AIRA](https://docs.kentico.com/documentation/business-users/aira.md#privacy-and-data-protection). ## Why security matters _KentiCopilot_ is designed to accelerate development while helping teams follow Xperience by Kentico best practices and architectural guidance. However, AI-assisted development introduces additional data flows beyond the Xperience platform itself. Source code, content models, configuration data, prompts, and other project information may be processed by AI tools and model providers that operate outside of Kentico's infrastructure. Understanding these data flows is important to help teams make informed decisions about what information is shared with AI systems, apply appropriate controls, and ensure AI-assisted development aligns with their organization's security, compliance, and data governance requirements. _KentiCopilot_ helps provide context and tooling for AI agents, but **customers remain responsible for selecting, configuring, and governing the AI tools** and model providers used in their development workflow. For the security of the Xperience platform itself, see [Security guidelines](https://docs.kentico.com/documentation/developers-and-admins/security-guidelines.md). To make security a recurring part of your workflow, use the recommended [security checklists](https://docs.kentico.com/guides/architecture/xperience-implementation-handbook/security-checklists.md) alongside the guidance on this page. ## Who owns which concern _KentiCopilot_ supplies MCP servers and instruction files that give an agent tools and context. Your AI tool supplies the agent, and your model provider supplies the language model. Throughout this page, _AI tool_ means the editor (IDE) or agent client you run, for example, [Claude Code](https://code.claude.com/docs/en/overview), [Cursor](https://cursor.com/docs), or [Visual Studio Code with GitHub Copilot](https://code.visualstudio.com/docs/setup/copilot/). It hosts the agent, starts the [Management MCP server](https://docs.kentico.com/documentation/developers-and-admins/api/management-api.md), and decides what gets sent to the model. Because responsibility is split this way, different parts of the setup answer different security questions. | | | | | ----------------------------------------------------------------------------------- | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Which data an agent can reach in your Xperience project | **Kentico** | Determined by what the management API exposes and by whether you enable it at all. | | What the Kentico-hosted MCP servers receive, log, and retain | **Kentico** | Kentico operates the [Documentation](https://docs.kentico.com/documentation/developers-and-admins/installation/mcp-server.md) and [Content Modeling](https://docs.kentico.com/guides/architecture/content-modeling/content-modeling-mcp.md) MCP servers. | | Whether any project data leaves your machine at all | **You** | The Management MCP server and the _KentiCopilot_ skills run on your machine. Project data crosses the boundary only through the model provider you connect and the Kentico-hosted MCP servers you choose to use. See [What leaves your machine](#what-leaves-your-machine). | | Which model processes your prompts, and whether the provider logs or trains on them | **You and your model provider** | Prompts and responses travel between your AI tool and the provider you choose, under that provider's terms. | | Which tool results get forwarded to the model | **Your AI tool** | An MCP server returns a result to the agent. The agent alone decides what goes into the next model request. | | Whether a destructive operation runs without a human confirming it | **Your AI tool** | Tool-approval prompts are a feature of the agent, not of the MCP protocol or of the Kentico servers. | ## How data flows The diagram below shows every connection a _KentiCopilot_ setup makes, which of them cross the boundary of your machine and network. See [What Kentico records](#what-kentico-records) for what each Kentico-hosted destination retains. ![KentiCopilot data flow, showing what stays on your machine and what leaves it](https://docs.kentico.com/docsassets/guides/kenticopilot-security/kenticopilot-data-flow.drawio.svg "KentiCopilot data flow, showing what stays on your machine and what leaves it") ### What leaves your machine The following table provides more detail on the data flows that do leave your machine. | | | | | -------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------- | | Your AI model provider | Your prompts, the definitions of every connected MCP tool, and any tool result your agent chooses to include, which can include content item field values returned by the [Management MCP server](https://docs.kentico.com/documentation/developers-and-admins/api/management-api.md). | Every turn of the conversation. | | [Documentation MCP server](https://docs.kentico.com/documentation/developers-and-admins/installation/mcp-server.md) | The search query text, plus the standard metadata of an HTTPS request. | A documentation search or page fetch. | | [Content Modeling MCP server](https://docs.kentico.com/guides/architecture/content-modeling/content-modeling-mcp.md) | The project description and draft content model you send for validation. | A content modeling workflow step. | > **Warning:** The largest flow is the one to your model provider, and it is governed by your agreement with that provider rather than by Kentico. Any content an agent retrieves through the Management MCP server can be forwarded to your model on the next turn. > > How that data is handled, whether it is retained, logged, or used to improve models, differs between providers and between tiers of the same provider, for example, [Claude Code data usage](https://code.claude.com/docs/en/data-usage). Where your project content carries regulatory or contractual obligations, check the terms of the tool and tier you use against them before you connect an agent to that content. ## What Kentico records This section explains what is recorded by Kentico. It applies only to the two Kentico-hosted MCP servers, the [Management MCP server](https://docs.kentico.com/documentation/developers-and-admins/api/management-api.md) records nothing at all. | | | | | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Documentation MCP](https://docs.kentico.com/documentation/developers-and-admins/installation/mcp-server.md) | That a search occurred, how long it took, how many results it returned, and which published documentation pages were returned. Standard request metadata accompanies these events. | **The query text itself.** It is never written to a log and never stored. Nothing about a documentation search is persisted to a database or file. | | [Content Modeling MCP](https://docs.kentico.com/guides/architecture/content-modeling/content-modeling-mcp.md) | Which workflow phase ran and whether it succeeded, together with the high-level answers you give during the requirements phase, such as the number of channels, team experience, and expected content volume. | **The draft content model.** Content type names, field names, and relationships are validated in memory and discarded. The server has no database and no storage of any kind. | Neither server persists customer project data. What you send is processed only to produce a response and is discarded afterwards. ## Security of each KentiCopilot component ### KentiCopilot skills and plugins [KentiCopilot](https://docs.kentico.com/guides/development/kenticopilot.md) skills and plugins are Markdown instruction files distributed through a public [GitHub repository](https://github.com/Kentico/xperience-by-kentico-kenticopilot). They contain no executable code, open no connections, and process no data. Their security relevance is that of any dependency you add to a repository. They steer an agent's behavior, and they should be reviewed like source code. Because you install them into your own repository, you can inspect every instruction before it takes effect, pin the version you reviewed, and change anything that does not suit your organization's policies. ### Management MCP server This is the only _KentiCopilot_ component that can reach your project data, and the most important one to configure deliberately. See [Configure the Management MCP](https://docs.kentico.com/documentation/developers-and-admins/api/management-api/configure-management-mcp-server.md) for the setup itself. > **Warning:** The [management API](https://docs.kentico.com/documentation/developers-and-admins/api/management-api.md) is intended **for local development only**. It provides authentication but no authorization, and must not be enabled on production deployments or on any publicly reachable instance. **Authentication** – The management API authenticates callers with a single shared secret of at least 32 characters. **Authorization** – The management API authenticates a _machine_, not a _person_. Every request executes with administrator-equivalent rights, independent of what the developer operating the agent may do in the administration interface. Workspace and permission checks do not constrain it. > **Key:** Anyone holding the management API secret has full read and write access to every workspace, channel, folder, and content item in the connected instance. Grant it the same way you would grant an administrator account. **Data made available** – Through the management API, an agent can read and write the content repository in full, including complete field values of content items and pages, along with the project's structural configuration. See [Reference - Management MCP capabilities](https://docs.kentico.com/documentation/developers-and-admins/api/management-api/reference-management-mcp-capabilities.md) for the exact list. Objects that hold personal data of your customers and users are **not** exposed. There is no endpoint for contacts, form submissions, members and their personal data, activities, the audit log, consents, or commerce orders and customers. > **Info:** You can narrow what an agent reaches further by limiting which tools the MCP server exposes, either from your AI tool's own configuration or with the server's command-line options. See [Limit the available tools](https://docs.kentico.com/documentation/developers-and-admins/api/management-api/configure-management-mcp-server.md#limit-the-available-tools). Tool limits govern what your AI tool can call. The management API itself still answers any request that reaches it directly. > > The capabilities reference describes the tool set in general terms. The authoritative list for your project is the set of tools the MCP server advertises to your AI tool in the version you are running, so check there to see exactly what an agent can do against your instance. ### Documentation MCP server The [Documentation MCP server](https://docs.kentico.com/documentation/developers-and-admins/installation/mcp-server.md) at `docs.kentico.com/mcp` is a public, unauthenticated, read-only search interface over published Xperience documentation. It is a search engine over pages that are already on the public web. - No credential is required and no project identity is transmitted. - No project data, no code, and no database content reaches it. The search query is the entire payload. - It cannot write anything to your project. A query can still carry project context, for example, an error message, a class name, or a project name that a developer pastes in to narrow the search. As we discussed in [What Kentico records](#what-kentico-records), that text is never logged or stored. ### Content Modeling MCP server The [Content Modeling MCP server](https://docs.kentico.com/guides/architecture/content-modeling/content-modeling-mcp.md) at `ai.kentico.com/content-model-mcp` supplies modeling prompts and deterministic validation tools. The language model runs on your side; the server performs no inference of its own. This is the non-local _KentiCopilot_ component that receives the most detail about your project, because a [modeling workflow](https://docs.kentico.com/guides/development/kenticopilot/build-content-model-with-mcp.md) deliberately sends it a project description and a draft content model. Nothing you send is persisted, the server has no database and no storage. > **Tip:** Content modeling works from structure and intent, not from real records. Describe the shape of your content, not its contents. Do not paste production content, customer records, credentials, or documents your organization classifies as confidential into a modeling session.