1. What This Service Does
The NYCU Library MCP Server (mcp.lib.nycu.edu.tw) connects your AI assistant, such as Claude or ChatGPT, to NYCU Library services. The current service provides only these tools:
search/render_search— search NYCU Library catalog recordsfetch— retrieve your own library account status
The service is provided exclusively to enrolled students and staff of NYCU.
2. Data Used by Each Tool
| Tool | Data used | Sent to | Stored by this service |
|---|---|---|---|
search / render_search | Your query text and search filters, such as resource type, access type, scope, sort, and offset | Ex Libris Primo | Catalog search results may be cached for 24 hours. The cache does not include your identity. |
fetch | Your student/employee ID, used to retrieve your own library account data | Ex Libris ALMA | Not stored. Loans, holds, and purchase requests are fetched live and returned directly. |
The fetch tool may return active loans, holds, pickup requests, and purchase requests, including titles, authors, due dates, request status, pickup location, and submission dates.
3. Login Data
When you authenticate through NYCU Identity Management (IDM), this service uses only the fields needed to identify you and check access:
- Student/employee ID — used as your account identifier and for the
fetchtool - Name, email address, and department — stored in your service profile
- User group — used only for access control and not stored after the access check
All other fields in the IDM payload are ignored.
4. What We Do Not Use
- No additional research or paper lookup tools are currently provided.
- Your data is not used for advertising, profiling, or training AI models.
- Your personal data is not sold or rented.
5. Data Retention
| Data | Retention |
|---|---|
| JWT access tokens | 3 days |
| OAuth authorization codes | 10 minutes |
| OAuth session (browser cookie) | 1 hour |
| Catalog search result cache | 24 hours |
| Identity record (student ID, name, email, dept.) | Until you request deletion or leave NYCU |
| Library account data (loans, holds, purchases) | Not stored — fetched live and returned directly |
6. Third-Party Services and Data Recipients
The service interacts with the following third parties. Each has its own privacy policy:
- NYCU IDM — identity verification at login
- Ex Libris Primo — catalog search; your query text and search filters are forwarded
- Ex Libris ALMA — account lookup; your student/employee ID is forwarded
- Anthropic / OpenAI — if you connect via Claude or ChatGPT, your tool inputs and outputs pass through their platforms. Their use of that data is governed by their respective privacy policies.
We do not sell, rent, or share your personal data with any party not listed above.
7. Security
- All traffic is encrypted in transit via HTTPS/TLS.
- JWT access tokens are short-lived and cryptographically signed.
- Raw credentials and full identity payloads are never written to logs.
- Redis data is stored on localhost only, not exposed externally.
8. Your Rights
You may at any time:
- Revoke access — disconnect the MCP server from Claude / ChatGPT in the respective app's settings
- Request deletion of your identity record by contacting the library (see §10)
- Request a copy of the personal data we hold about you
9. Changes to This Policy
We may update this policy from time to time. Material changes will be announced on the landing page (mcp.lib.nycu.edu.tw) and the "Last updated" date above will reflect the revision.