MCP Rate Limiting and PII Redaction for Production Servers

MCP rate limiting decides how many requests an AI client can send your server each minute. PII redaction decides what personal data the client gets back. GetMCP builds both into every server, together with timeouts, retries and a request size cap, so you can let an MCP server go live without hoping that every client behaves.

This guide is for anyone running a GetMCP server that real people or agents depend on. That could be an agency serving a client’s store, a SaaS team publishing its API to Claude, or an ops team running an internal server. It covers where each control lives, what the settings do, and the edge cases worth knowing before launch.

What are GetMCP’s production controls?

An MCP server sits between a model and an API. The model decides when to call a tool, how often, and with what arguments. Production controls are the limits you set on that relationship, enforced on your own server before a request reaches the upstream API or a response reaches the model.

Most of them live on each server’s Settings tab: Rate Limiting, Timeouts and PII Redaction. The install-wide default rate limit is under Settings → General. Per-tool timeouts, caching and retries are in the Tool Editor under Advanced Settings.

How MCP rate limiting works in GetMCP

Every request to a server endpoint passes the same checks, in this order:

1. Authentication. A failed sign-in is counted on its own budget: by default 20 failed attempts per minute, per IP address, per server. After that the endpoint answers HTTP 429 with “Too many failed authentication attempts”, so nobody can grind through API keys for free.
2. The server’s rate limit. Each client IP has its own per-minute allowance on each server. Over the limit, the client gets HTTP 429 with a JSON-RPC -32000 error (“Rate limit exceeded. Try again later.”) and a Retry-After header.
3. Request size. Bodies over 1 MB are refused with HTTP 413.
4. Batches. Older clients can send several JSON-RPC calls in one POST. Each call in a batch costs one unit of the allowance, so batching cannot get around the limit.
5. The tool’s own limit. A tool can carry an extra per-minute cap on top of the server’s. It is checked per call and answered with a JSON-RPC error naming the tool, so one throttled tool does not fail other calls in the same request.

The limiter uses a sliding window. Counts are kept in one-minute buckets, but the previous minute still counts for the share of it that falls inside the last 60 seconds. A client cannot spend a full allowance at :59 and another at :00. Successful responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers, so well-behaved clients can pace themselves.

To set a server’s limit, open the server, go to the Settings tab and use the Rate Limiting section.

Plan call allowance

Apart from your own limits, some GetMCP plans carry a monthly call allowance over a rolling 30-day period. When it runs out, tool calls return a JSON-RPC -32000 error that says so, with retry_after and an upgrade link in the error data, rather than a fake tool result. Tools you already built keep their configuration. See pricing for what each plan includes.

How PII redaction works

PII redaction removes personal data from tool responses and call logs on your server, before anything leaves it. Matches are replaced with labelled placeholders such as [REDACTED:EMAIL] rather than blanked. The model knows a value was removed and can ask the user for it instead of guessing.

Redaction runs after your JMESPath or JSONPath selector has pruned the response and before any output template formats it. So the selector decides which fields the model sees, and redaction cleans what is left. On the log side it covers the stored arguments, the response, the replay payload and the error message.

Here is an upstream customer record before and after, with the email, card and IP detectors switched on:

// upstream response
{ "customer": "Priya Sharma",
  "email": "[email protected]",
  "card": "4242 4242 4242 4242",
  "ip": "203.0.113.42" }

// what the model and the call log receive
{ "customer": "Priya Sharma",
  "email": "[REDACTED:EMAIL]",
  "card": "[REDACTED:CARD]",
  "ip": "[REDACTED:IP]" }

Key settings

Setting	Where	What it does
Default Rate Limit (requests/min)	Settings → General	Install-wide default, 1 to 10,000 per client per minute. Shipped at 60. Used by any server set to 0.
Requests per minute	Server → Settings → Rate Limiting	This server’s limit per client. 0 inherits the global default.
No rate limit	Server → Settings → Rate Limiting	Accepts every request. Only safe when something in front of the site already throttles. The server’s readiness check flags it as a warning.
Default timeout (seconds)	Server → Settings → Timeouts	How long a tool waits for the upstream API, 1 to 300 seconds. Tools can override it.
Timeout, Cache TTL, Retry Count, Retry Backoff	Tool Editor → Advanced Settings	Per-tool timeout, a response cache of 0 to 86,400 seconds, up to 5 retries, and None, Linear (1s, 2s, 3s) or Exponential (1s, 2s, 4s) backoff.
Enable PII redaction	Server → Settings → PII Redaction	Off by default. When off, responses and logs are stored as they are.
Apply to	PII Redaction	Both AI responses and call logs, AI responses only, or call logs only.
Built-in detectors	PII Redaction	Email addresses, US Social Security numbers, credit card numbers (13 to 19 digits), phone numbers, IPv4 addresses, AWS access keys (AKIA…) and JWT tokens (eyJ…).
Custom rules	PII Redaction	A label, a PCRE regex pattern and a replacement (default [REDACTED]). Invalid patterns are dropped on save.

Taken together, MCP rate limiting at the server, per-tool caps and timeouts bound both how often and how long a model can lean on your API. Retries apply to connection errors and to HTTP 408, 429, 500, 502, 503 and 504 responses. Other errors go straight back to the model, so a 404 or a validation error is not repeated pointlessly.

Use cases

Keep a store’s order API under its own limits

Acme’s WooCommerce host throttles heavy API use. Set the server to 30 requests per minute and turn on retries with exponential backoff for the order tools, so a busy afternoon of agent questions slows down instead of tripping the host’s limits.

Claude asks about orders → rate limit (30/min) → list_orders → retry on 429 → answer

Give support agents customer context without card numbers

A support team connects ChatGPT to the billing API to look up customers. With redaction set to Both and the card and email detectors on, agents get plan, status and invoice history, while card numbers and addresses never reach the model or the call log.

Ticket arrives → get_customer → PII redaction → model drafts the reply

Let the model see data the logs must not keep

Sometimes the assistant needs the real email address, to address a reply for example, but your retention policy says logs must not hold it. Choose Call logs only: the model gets the value, and the stored arguments and responses are scrubbed.

Mask your own identifiers with a custom rule

Northwind’s HR API returns employee numbers like EMP-104233. Add a custom rule with the pattern EMP-\d{6} and the replacement [REDACTED:EMPLOYEE], and every response and log entry is cleaned the same way.

Protect an expensive endpoint inside a cheap server

A SaaS server mixes fast lookups with one report-generation tool that is slow and costly upstream. Leave the server at 120 requests per minute and give the report tool its own cap of 5 per minute, so an agent stuck in a loop cannot run up the bill.

Agent loop → generate_report → per-tool cap (5/min) → JSON-RPC error with retry_after

Stop key guessing on a public endpoint

An internal ops server is reachable on the internet so Cursor can use it from anywhere. The failed-authentication budget means a script guessing API keys is throttled to a handful of tries per minute per IP, on top of the normal limit for signed-in clients.

Tips and gotchas

• Behind a proxy, every client can look like one IP. MCP rate limiting in GetMCP counts per IP and ignores X-Forwarded-For unless a developer enables the getmcp_trust_proxy_headers filter. Only do that when a proxy such as Cloudflare or a load balancer sets the header reliably.
• 0 and “No rate limit” are different. 0 means “use the global default”. The toggle stores an explicit unlimited value that ignores the default.
• Per-tool limits are not in the Tool Editor. Set rate_limit_per_min on the tool through the getmcp/v1 REST API. It travels with a server export.
• Redaction only scans text. A phone number returned as a JSON number, not a string, passes through. Strings over 1 MB are skipped so the regex engine cannot stall a request.
• Broad detectors can over-match. The card detector matches any run of 13 to 19 digits, which can include long order or tracking numbers held as strings. Switch on only the detectors a server needs.
• Test before you trust a custom rule. Run the tool from the Tool Editor’s Test panel and look at the output and the call log.
• Connector tools get the same controls. Mailbox, database and file server tools go through the same limits, redaction and logging as HTTP tools.

Related features

• Analytics and call logs: see every call, the 429s included, and confirm redaction on stored entries.
• The Tool Editor: prune responses with JMESPath before redaction runs, and set timeouts and retries.
• The MCP Gateway: one endpoint for several servers, with its own per-client limit.

FAQ

What happens when an MCP client hits the rate limit?

The server answers HTTP 429 with a JSON-RPC -32000 error and a Retry-After header. A per-tool limit answers with a JSON-RPC error that names the tool and includes retry_after. Most clients pass that on to the model, which waits or tries something else.

Is the rate limit per user or per server?

Both, in a sense. The limit is set per server and counted per client IP address, so two clients on the same server each get the full allowance. Clients behind one shared IP share it.

Does PII redaction change what my API receives?

No. Redaction applies to the response on its way back to the model and to what the call log stores. The arguments sent upstream are unchanged; with log redaction on, only the stored copy of them is scrubbed.

Can I redact data that is not in the built-in list?

Yes. Add a custom rule with your own label, a PCRE regex and the replacement text. Use a descriptive replacement such as [REDACTED:ACCOUNT] so the model knows what kind of value was removed.

Does GetMCP retry failed API calls?

Only when you ask it to. Retry Count is 0 by default; set it to up to 5 per tool, with no delay, linear or exponential backoff. Retries cover connection errors and the 408, 429, 500, 502, 503 and 504 status codes.

Rate limits, timeouts and redaction are settings, not code, so you can tighten a server the day it goes live and relax it once you trust the traffic. Read more on the security page, or compare plans on pricing.