AI assistant access to the Ontology

The Ontology MCP lets an AI assistant read the Datastruct Ontology while you work in chat. The assistant connects with a personal OAuth credential that you create in Datastruct Console, and it acts only as you.

The Ontology as a graph

The Ontology links business needs to the third-party data that answers them. It is organized as a graph:

• Business segments form a hierarchy: industry, line of business, function group, and business function.
• A business function asks concerns, which are business questions.
• A concern breaks down into sub-concerns, which are specific questions about a subject, such as a property or a vehicle.
• Data sources from data providers cover sub-concerns and output data features, which are individual attributes such as flood depth.

The same graph appears on the Ontology pages in Console. The Model Context Protocol (MCP) is an open standard that lets AI assistants call external tools. The Ontology MCP exposes the graph as read-only tools, so an assistant can answer a question such as “what data helps with flood risk?” by searching the graph and following its links.

Why the assistant acts as you

An Ontology MCP connection is personal. It does not use an organization-wide key or a workflow credential. Each credential belongs to the user who created it, and only that user can approve it, use it, or rotate its secret.

This keeps the assistant inside your own access boundary:

• It can read only the parts of the Ontology your organization can view in Console.
• It stops working when your Console account is deactivated.
• Each answer links back to the matching Console page, so you can verify it.

The assistant cannot change the Ontology or any other Datastruct data. Every Ontology MCP tool is read-only.

How a connection is established

A connection involves three parties: the assistant, Datastruct Console, and the Datastruct authorization server.

1. You create a credential in Console. Datastruct shows its client secret once and does not store it.
2. You add the MCP server URL, client ID, and client secret to the assistant.
3. The assistant finds the authorization server from the MCP server URL and sends you to a Datastruct approval page.
4. You sign in to Console, if needed, and authorize the assistant.
5. The assistant receives short-lived access tokens and calls the Ontology MCP with them.

You approve the connection once. The assistant renews its access tokens without asking you again until the credential expires or is revoked.

Lifetime and revocation

A credential has an expiration that you choose when you create it, like a personal access token. It stops working at the end of its last day in your time zone. You can also create a credential without an expiration, although setting one is safer.

Revocation is immediate. Revoking a credential, rotating its secret, or deactivating its owner stops the Ontology MCP from accepting the assistant’s tokens on the next request, not when the token expires. Rotating a secret also requires the assistant to be configured with the new secret.

Organization admins who manage credentials can revoke any user’s OAuth credential in their organization. They cannot view secrets or create credentials for another user.

Boundaries and trade-offs

• Availability. OAuth credentials require Datastruct to enable them for your organization, and the Ontology must be available in your organization’s Console. Contact Datastruct if the option is missing or unavailable.
• Personal scope. Today’s credentials are personal. A shared assistant or automated service would act as the user who created its credential.
• Stolen credentials. A client ID and secret alone cannot get a token. The owner must also sign in to Console and approve the connection. An assistant that already holds a token acts as you until you revoke or rotate the credential, so revoke a credential you suspect is exposed.
• Answer quality. The assistant composes its answer from tool results. Verify important findings against the linked Console pages.

Related reference

• Ontology MCP defines the server URL, authorization, and errors.
• Ontology MCP tools lists each tool, its arguments, and its results.
• Credential security explains how Datastruct protects data vendor credentials, which are separate from OAuth credentials.