Authorization codes expire in five minutes, are one-time use, and require the S256 verifier. Every access token is resource-bound to the v1 endpoint.
PrimeSync StudioSecurity center
Security claims, including the limits.
PrimeSync Studio is OAuth-gated and bounded, but it has not completed an independent security audit. This page separates implemented controls from work that is still outstanding.
Implemented controls
Build, audit, and validation permissions are approved separately. A missing scope is rejected before tool work begins.
Access tokens last one hour. Refresh tokens last up to 30 days, rotate on use, and revoke the connection when reuse is detected.
Access tokens, refresh tokens, and authorization codes are stored as SHA-256 hashes, not plaintext.
30 calls per minute per connection and 5.5 MB per MCP request. Validation uses deterministic in-process computation only.
No submitted-code execution, shell, broker, TradingView account, exchange, order, or market-data network access exists in the MCP tools.
Current assurance status
PublisherPrimeSync Project · [email protected]
Named legal operatorNabeh Kheir · Israel
Domain relationshipprimesync.me links directly to ai.primesync.me and uses the same support domain.
Developer-platform identity verificationMust be completed in the submission portal before directory review
Independent security reviewNot completed
Public bug bountyNot established
Public source repositorySource is currently private
Recognized MCP directoryNot yet published; review materials are being prepared
Do not describe PrimeSync Studio as independently audited, SOC 2 certified, TradingView endorsed, or directory-approved. None of those claims is currently true.
Report a vulnerability
Email [email protected] with the affected endpoint, impact, reproduction steps, and a safe proof of concept. Do not include live credentials or other people's strategy code.