Please report suspected vulnerabilities privately to security@close.com. Do not open a public issue for a security vulnerability.

This plugin contains no credentials and does not proxy Close data. The agent client connects directly to Close's hosted MCP server over HTTPS and manages OAuth discovery, authorization, and credential storage. Users choose the Close organization and permission scope during authorization and can revoke access from their Close account.