Tokens last an hour, and renew themselves. A connected assistant holds a refresh token that it trades for a new access token as it goes — you won't be asked to sign in again unless it sits unused for 90 days or you disconnect it. A refresh token is good once; if one is ever presented twice, the connection is cut, since that means a copy of it exists somewhere it shouldn't.

Rate limits are the API's, shared with everything else the company does through the API. A tool call spends two requests against that budget — one for the MCP call, one for the API call it makes — so plan for roughly half the throughput you'd get from the REST API directly.

Usage counts, and is kept. Every tool call is logged with the tool, the company, the outcome and how long it took — open the connection under Dev Tools → MCP for its requests per day and the last 200 calls, kept for 90 days, beside a history of who changed what it may do.

Results are capped at 50 records per call, and trimmed further if a page would be enormous. When that happens the result says so — a truncated answer never pretends to be complete.