# README

Rockhopper is a version control and collaboration platform for Excel spreadsheets. It integrates directly into Microsoft Excel (and Google Sheets) so finance and accounting teams can track every change, review each other's work, and manage versions — without leaving their spreadsheet.

## For everyday users

**Looking to learn how Rockhopper works?**

Start with the [Product Guide](/product-guide/overview) for a walkthrough of enrolling files, tracking changes, collaborating with comments, requesting reviews, and managing versions.

## For IT and security teams

**Evaluating Rockhopper for your organization?**

The [Security & Compliance](/security-and-compliance/overview) section covers how we protect your data — architecture, encryption, access controls, and our approach to compliance. Written for CISOs, security reviewers, and IT leadership.

**Ready to set up Rockhopper?**

The [IT Setup](/it-setup/prerequisites) section has everything you need to connect your Microsoft 365 or Google Workspace tenant, deploy the Excel Add-in, and verify technical requirements.

## Need help?

Reach out to your Rockhopper Account Manager or contact us at <support@rockhopper.co>.


# Overview

Spreadsheets are essential tools for finance and accounting teams. They're flexible, powerful, and deeply embedded in workflows — but as teams grow and complexity increases, they start to break down. Versioning becomes unclear, changes go untracked, and reviews happen over email or chat with no formal record.

Rockhopper fixes this. The platform integrates directly with **Microsoft Excel** and **Google Sheets**, connecting to your existing file systems (OneDrive, SharePoint, and Google Drive) so you can keep working in the tools you already use — with structure, oversight, and confidence layered on top.

![Rockhopper version comparison showing a financial model with a change log](/files/dbJItdOvx31Fw5b3T5hT)

## What Rockhopper does

### Version control

Every change to an enrolled spreadsheet is tracked. You can view a detailed change log across cells, tabs, and workbooks, and understand exactly who changed what and when.

### Change tracking and auditing

Go beyond knowing what changed — understand *why* it changed. Rockhopper tracks dependencies, assumptions, and context alongside every edit.

### Formal review and approval

Replace email chains and side conversations with structured review workflows. Request reviews from teammates, track approvals, and maintain a complete record of who signed off on what.

### Progress and accountability

See which files have uncommitted changes, who's working on what, and whether reviews are pending or complete. Nothing falls through the cracks.

## Common use cases

Rockhopper supports spreadsheet workflows where alignment, trust, and accuracy matter most:

* **Cash flow rollforwards** — Critical daily updates with high visibility and assumption sensitivity
* **Consolidation schedules** — Managing inputs across multiple business units or entities
* **Intercompany eliminations** — Tracking adjustments and reducing duplication
* **Flux / variance analysis** — Connecting drivers and explanations to changes over time
* **Project finance models** — Coordinating updates across complex, multi-phase scenarios
* **Journal entry tracking** — Ensuring accuracy and alignment of manual entries
* **Reconciliation schedules** — Validating data and assumptions across systems

## Supported platforms

Rockhopper works with the tools your team already uses:

| Platform      | File storage         | Spreadsheet editor        |
| ------------- | -------------------- | ------------------------- |
| **Microsoft** | OneDrive, SharePoint | Excel (desktop, web, Mac) |
| **Google**    | Google Drive         | Google Sheets             |

You don't need to move files or change your workflow — Rockhopper connects to your existing cloud storage and layers version control, change tracking, and reviews on top.

## How it works — the quick version

1. **Enroll** a spreadsheet from OneDrive, SharePoint, or Google Drive
2. **Work normally** in Excel or Google Sheets — Rockhopper tracks every edit automatically
3. **Review changes** in a visual diff that highlights exactly what changed, who changed it, and when
4. **Commit versions** when you're ready to create a formal checkpoint
5. **Request reviews** from teammates for structured sign-off before finalizing

Everything is connected: comments reference specific cells and versions, reviews tie to uncommitted changes, and the full history is always one click away.


# Getting Started

## Signing in

Go to [app.rockhopper.co](https://app.rockhopper.co) or click the invite link in your email. Sign in with your Microsoft or Google account to access Rockhopper.

![Rockhopper sign-in page](/files/5qIaJyyoGa1ohFGXgtaF)

![Microsoft account picker](/files/a2U0cDMIsTr2b8KTRNwQ)

## My Files

After signing in, you'll land on the **My Files** page. This is your home base — it shows every spreadsheet you're tracking in Rockhopper. From here you can:

* See all enrolled files and their current status
* Spot which files have uncommitted changes (marked with indicators)
* Open files to view their version history
* Enroll new files or invite teammates

![My Files page — empty state](/files/9kvGPtIU6kIIgFkZURhY)

### Status indicators

Each file in the list shows at-a-glance status information:

| Indicator         | Meaning                                                 |
| ----------------- | ------------------------------------------------------- |
| **Red dot**       | You haven't seen the latest changes yet                 |
| **Change count**  | Number of uncommitted edits since the last version      |
| **Version badge** | The latest committed version number (e.g. v1.2.0)       |
| **Review status** | Whether reviews are pending, approved, or not requested |

### Filtering files

Click the **filter icon** next to the page header to narrow the list. Available filters:

* **All files** — every enrolled file (default)
* **Uncommitted changes** — only files with edits that haven't been versioned
* **Since yesterday / last week / last month** — files with activity in that time range

Click **Clear** to remove the filter and return to the full list.

## Team members and roles

Rockhopper uses roles to control who can do what within your team:

| Role            | What they can do                                                          |
| --------------- | ------------------------------------------------------------------------- |
| **Admin**       | Full access — manage team members, assign roles, and oversee all activity |
| **Manager**     | Invite team members and dismiss any pending review requests               |
| **Contributor** | Standard access — can create and dismiss only their own review requests   |

### Inviting someone

Click **Team Members** at the top of the My Files page (available to Admins and Managers).

![Team Members button at the top of My Files](/files/bBk8seX7NJZ4QWHqBeMj)

Enter the person's email address, choose a role, and send the invitation. They'll receive an email with instructions for joining.

![Invite dialog with role selection](/files/U6vRVuqzxd4TlDpoNu5j)

![Team members list showing invited members](/files/TqjZOzJrZFMZ1XxAgQN0)

### Removing someone

Open the Team Members list, click the options menu (**...**) next to the person, and select **Remove from team**. They'll lose access to the workspace immediately.

![Remove from team option in the team members panel](/files/NvIHKrCM9DDFhc3S8Jnl)


# Enrolling Files

Before Rockhopper can track changes to a spreadsheet, you need to **enroll** it. Enrollment connects the file to Rockhopper and creates the first version automatically.

## How to enroll a file

1. From the **My Files** page, click the **File Manager** button (top right)

![File Manager button on the My Files page](/files/JL6rdfhrr5CKDb2FA4T6)

2. A side panel opens showing the spreadsheets you have access to in OneDrive, SharePoint, or Google Drive
3. Select the files you want to enroll
4. Click **Enroll file(s)**

![File Manager side panel with files selected for enrollment](/files/BuWw3yAYrCX012cxQjUG)

Rockhopper takes a snapshot of each file and creates an initial version. From this point forward, every change is tracked.

{% hint style="info" %}
If a file has already been enrolled by a teammate but isn't showing on your My Files page, click the **+** icon next to the file name in the File Manager to add it to your view.
{% endhint %}

![Add to My Files plus icon for already-enrolled files](/files/jrkbwbjLWkuWK6Yr8yNu)

![My Files page with enrolled files showing version info](/files/SnesH7YWekpPCJQ80gr2)

## The File Versions page

Click on any file from My Files to open its **File Versions** page. This is where you manage the file's lifecycle.

![File Versions page showing version history](/files/q7NrQL76vOqbT4v17N29)

The version list shows every committed version with:

* **Version number** (e.g. v1.0.0, v1.1.0) and who created it
* **Description** — the note written when the version was committed
* **Timestamp** — when the version was created, displayed in your timezone
* **Status** — whether the version is current, discarded, or reverted

From this page you can:

* Click any version row to open the [difference analysis view](/product-guide/tracking-changes#the-difference-analysis-view)
* **Download** any version as a file (click the download icon on the row)
* **Open the live file** in Excel or Google Sheets
* Access the [Comments](/product-guide/comments) and [Reviews](/product-guide/reviews) panels via the navigation bar
* [Create a new version](/product-guide/versions#creating-a-version), [discard changes](/product-guide/versions#discarding-changes), or [revert](/product-guide/versions#reverting-to-a-previous-version)
* [Pause or unpause edits](/product-guide/versions#if-other-users-are-working-on-the-file) when you need exclusive access


# Tracking Changes

## Opening a live file

To start tracking changes, open an enrolled spreadsheet. You can do this from:

* **My Files** — click the **Open live file** icon next to any file
* **File Versions** — click the **Open live file** button at the top right
* **OneDrive, SharePoint, or Google Drive** — open the file directly from your file system

![Open live file options from My Files and File Versions pages](/files/UYoGvxQhI8b6i0s4X6sj)

For Excel files, the Rockhopper add-in appears on the right side of the screen. Sign in with your Microsoft account to connect. For Google Sheets, the Rockhopper sidebar activates automatically.

![Excel with the Rockhopper add-in sign-in panel](/files/36Y1BPQ0buCGMBd51JcG)

![Allow popup dialog and Microsoft account picker](/files/1hT0FC6Rzjkx9zg2Pxy9)

## How change tracking works

Once connected, Rockhopper tracks every edit you make. Tracking works even if the Rockhopper side panel is closed.

![Rockhopper add-in showing "Tracking changes" status](/files/9AHEy81ITZ0zOttH1hYH)

Rockhopper captures two levels of changes:

**Cell-level changes** — any edit to a cell's value, including formulas, formatting, and cleared cells. Each change records the old value, new value, cell address, and who made the edit.

**Worksheet-level events** — structural changes to the workbook itself:

* **Sheet added** — a new worksheet was created
* **Sheet deleted** — an existing worksheet was removed
* **Sheet renamed** — a worksheet's name was changed

All changes are tracked per-user, so Rockhopper always knows who made each edit.

### Excel vs. Google Sheets

Rockhopper works with both platforms. The core experience — change tracking, versions, comments, and reviews — is the same. A few differences:

|                    | Excel (OneDrive / SharePoint)                  | Google Sheets (Google Drive)                  |
| ------------------ | ---------------------------------------------- | --------------------------------------------- |
| **Connection**     | Rockhopper add-in panel appears in the sidebar | Rockhopper sidebar activates automatically    |
| **File browser**   | Shows OneDrive and SharePoint files            | Shows Google Drive files                      |
| **Authentication** | Microsoft account (Azure AD)                   | Google account                                |
| **Deep link**      | Opens from My Files or File Versions           | Also works from the Google Sheets add-on menu |

## Uncommitted changes

When changes are made to an enrolled file, Rockhopper flags it as having **uncommitted changes** — edits that exist in the live file but haven't been saved as a formal version yet.

You can review uncommitted changes before deciding to commit a new version or discard them:

* From **My Files** — click **View changes** on any file with a change indicator. A red dot means you haven't seen the latest changes yet.
* From **File Versions** — click the **View changes** button in the status bar.

![View changes button on My Files page](/files/oTrptLKYHnrMs6h9eYC5)

![View changes button on the File Versions page](/files/rn44g6tDAiaM5p7gBWlC)

## The difference analysis view

This is where you review what changed. The screen is split into two areas:

**Left side — the spreadsheet.** Changed cells are highlighted with a blue border. Use the sheet selector at the bottom to switch between worksheets.

**Right side — the context panel.** Three tabs give you different views:

| Tab            | What it shows                                                                                        |
| -------------- | ---------------------------------------------------------------------------------------------------- |
| **Change Log** | A structured list of every change — sheet-level events and cell-level edits — organized by worksheet |
| **Comments**   | The file's comment thread                                                                            |
| **Reviews**    | Review requests and their approval status                                                            |

Unread changes are flagged with a red dot, both on individual items and on sheet tabs that contain unseen edits.

![Difference analysis view with change log and highlighted cells](/files/mxAoWOyNRBrNAX3lOabV)

{% hint style="info" %}
Changes may take a moment to appear if the file is still syncing with Microsoft or Google. Rockhopper updates the change log automatically once processing is complete.
{% endhint %}

## Navigating to a change

Click any item in the Change Log to jump directly to the affected cell in the spreadsheet view.

![Changed cell highlighted in the spreadsheet with the corresponding change log entry](/files/qgxeOrTLp0Lbv5s3h7oH)

## Cell edit history

Want to see the full history of a specific cell? Right-click on any changed cell and select **View edit history**. You'll see a complete record of every edit to that cell — who made each change and on which version.

![Cell edit history context menu](/files/PuJnOYc3dxwOGTte6ica)

![Cell edit history panel showing the full change record](/files/Ze7t9a4EktUv0wy7szTa)


# Comments

Every file in Rockhopper has a comment thread where your team can discuss changes, ask questions, and make decisions — all tied to the file and its version history.

## Accessing comments

You can open the comment panel from:

* **File Versions page** — click the comment icon in the top navigation bar
* **Difference Analysis page** — select the **Comments** tab in the right-hand panel

![Comment icon in the top navigation bar](/files/RyFsSvun2ZMkQ8UQo10p)

A red dot on the icon means there are unread comments. Each comment is automatically tagged with the file version that was active when it was written. Comments made while changes are uncommitted are labeled **Uncommitted** until a new version is created.

![Comments panel showing version-tagged comments](/files/eYmiE4X5K2HoNiENBNMO)

## Tagging people, versions, and cells

Rockhopper comments support three types of inline tags that keep discussions precise and connected to the work.

### @mention a team member

Type **@** and pick a name from the dropdown. The person will receive an email notification. Use this to assign tasks, ask questions, or flag something for someone's attention.

![Typing @ to tag a team member in a comment](/files/LqrfQOkZaSzlGvtRiIZd)

### #reference a version

Type **#** and select a version number. This creates a clickable link so anyone reading the comment can jump straight to that version's details.

![Typing # to tag a file version in a comment](/files/1GZKDhRqVw0FuK07KCIN)

### =reference a cell

Right-click on a changed cell in the spreadsheet and select **Add comment**.

![Right-click context menu with "Add comment" option](/files/Jzelb1KxJMeXXiMtwpIu)

Rockhopper inserts a clickable cell reference (like `Sheet1!B4`) into your comment. When someone clicks the reference, the spreadsheet navigates to that cell.

![Comment with a clickable cell reference tag](/files/GYRMNdBLTKB8XbsIBl4T)

You can also type **=** directly in the comment input to reference a cell by address.

## Filtering and editing

**Filter by person** — Click a team member's name in the comment panel to see only their comments. Clear the filter to return to the full thread.

![Comments filtered by team member](/files/tjl61HwUpOkAOcRki8lu)

![Filter active showing a single team member's comments](/files/MwB0Bss9yGvgCDdyGtTS)

**Edit your comments** — Click the options menu (**...**) on any of your comments and select **Edit**.

![Edit comment option in the menu](/files/7LYv7mrMHMpHZeELoynJ)

## Resolved comments

Comments that have been resolved show a green **Resolved** badge. Resolved threads are hidden by default — use the **Resolved threads** filter to bring them back into view.

{% hint style="info" %}
Comment resolution is currently available through the [AI assistant integration](/product-guide/ai-assistant) (via the `resolve_comment` tool) rather than a button in the web app. A UI toggle is planned for a future release.
{% endhint %}

## Deleting a comment

To delete a comment you wrote, click the options menu (**...**) and select **Delete**. Deleted comments are removed from the thread permanently. You can only delete your own comments.


# Reviews

Reviews let you get formal sign-off from teammates before committing a new version. This is how Rockhopper replaces informal review processes — email chains, Slack messages, or verbal approvals — with a structured, auditable workflow.

## When to use reviews

Any team member can request a review on a file that has uncommitted changes. Common scenarios:

* A contributor finishes updating a model and wants a manager to verify the changes before the version is committed
* A team lead wants sign-off from two reviewers before locking in a quarterly close spreadsheet
* Someone spots an issue and wants to flag it for review before discarding changes

## Requesting a review

1. Open the **Reviews** panel (from the File Versions page or the Difference Analysis page)

![Reviews panel icon in the navigation bar](/files/XXBnueXnY8RkIY9njcqr)

You can also access the reviews panel from the Difference Analysis page.

![Reviews tab in the Difference Analysis right panel](/files/HpGppOgIxbFRzMGBc5q7)

2. Click **Request review**
3. Enter a subject line describing what needs review
4. Select one or more reviewers from the dropdown
5. Add a brief description with context or instructions
6. Submit

![Review request form with subject, reviewers, and description](/files/vAjPDGRiHv8Drv5Zozj5)

Reviewers receive an email notification. The review appears in the Reviews panel with a **Pending** status.

![Review showing as Pending in the Reviews panel](/files/tyjxVJJUL6TXt2NPFEgi)

## Reviewing and approving

When you're assigned a review:

1. Open the review from the Reviews panel or from the email notification
2. Look at the file diff to understand what changed

![Review details panel showing reviewer statuses](/files/KXSLoLIj93sqlmJq2TLt)

![Expanded review details with activity history](/files/lJZYcfNP7co2U2fAxFNS)

3. Use the **Comments** tab within the review to leave feedback or ask questions (these comments also appear in the main comment thread)

![Comments tab within a review](/files/r5cBPYm1hJS6oT1vwZAu) 4. When you're satisfied, click **Approve** and add an optional note

![Approve review dialog](/files/quHHYMPoROHmpVRTKNwq)

![Review marked as Approved](/files/kXCVPyQ1gUgTkZZgAbDN)

The review is marked **Approved** once every assigned reviewer has approved.

## Review statuses

| Status        | Meaning                                              |
| ------------- | ---------------------------------------------------- |
| **Pending**   | Waiting for one or more reviewers to respond         |
| **Approved**  | All reviewers have approved                          |
| **Cancelled** | The review was dismissed by the creator or a manager |

## Creating versions with pending reviews

What happens if you try to create a new version while reviews are still pending?

| Your role       | What you can do                                             |
| --------------- | ----------------------------------------------------------- |
| **Manager**     | Can dismiss any pending review and proceed with the version |
| **Contributor** | Can only dismiss reviews you originally requested           |

![Manager dismissing pending reviews when creating a version](/files/CzsPz5tA8L6d5NtAccpG)

![Contributor cannot dismiss reviews they didn't request](/files/0EVKClWpp2A9PmGyD7Uw)

## Editing a review

The person who created a review can edit it at any time — click the options menu (**...**) on the review and select **Edit**.

![Edit review option in the menu](/files/GWb6YpbsRAGpzBU2kcEL)


# Versions & Reverting

## Creating a version

When you're ready to save your uncommitted changes as a formal version:

1. Click **Create version** in the top navigation bar of the Difference Analysis page
2. Choose a version number — **major**, **minor**, or **patch** — depending on the significance of the changes
3. Write a short description of what changed and why

![Create version button in the navigation bar](/files/JhUhrIgM5X9iNI2CyhmS)

![Create version dialog with version number and description](/files/JqAZSY5VaAXTwGaTCfBu)

### Choosing a version number

| Increment | When to use                                                                           | Example         |
| --------- | ------------------------------------------------------------------------------------- | --------------- |
| **Major** | Significant structural changes — new sheets, major model revisions, period-end closes | v1.0.0 → v2.0.0 |
| **Minor** | Meaningful updates — new assumptions, added rows/columns, formula changes             | v1.0.0 → v1.1.0 |
| **Patch** | Small corrections — fixing a typo, adjusting a label, minor formatting                | v1.1.0 → v1.1.1 |

There's no enforcement — pick whichever feels right for the scope of the changes. The version number is a communication tool for your team, not a technical constraint.

The new version appears on the File Versions page with your description and a timestamp. Rockhopper now treats this as the latest committed version, and any future edits will show as new uncommitted changes.

![Newly created version on the File Versions page](/files/3ldeXu4l3dpSKbDBMHfz)

## Viewing a past version

Click any version on the File Versions page to see a detailed comparison. Rockhopper highlights every difference between the selected version and the one before it — so you can see exactly what changed in that update.

![Version comparison view showing differences](/files/majW4mxpwVgZH9ZX9iND)

## Downloading a version

You can download the Excel or Google Sheets file as it existed at any committed version. On the File Versions page, click the **download icon** on the row for the version you want. The file downloads with its original name.

This is useful when you need to:

* Share a point-in-time snapshot with someone outside your team
* Open an older version locally for offline analysis
* Archive a specific version for compliance or audit purposes

## Discarding changes

Sometimes uncommitted changes shouldn't become a version — maybe they were exploratory, or an error was made. You can discard them:

1. On the Difference Analysis page, click **Discard**
2. Write a short note explaining why you're discarding
3. Confirm

![Discard button on the Difference Analysis page](/files/eiSBgAbvwbiJ4RW9nCgf)

![Discard confirmation dialog](/files/00snwY4mFiA3BJc9hqji)

The live file reverts to the latest committed version. Discarded changes are preserved in the version history for audit purposes — nothing is permanently lost.

![Discarded changes shown in version history](/files/Sn9RYUrQOT8eiG6y4GR4)

### If other users are working on the file

You can't discard changes while others have the file open. Click **Request to pause edits** to notify everyone.

![Pause edits request dialog for discarding](/files/7Y1j3BvzMlk5TEJlsKJY)

They'll get an email and an in-app alert asking them to close the file. Once everyone has closed it, you can proceed.

![File paused — ready to discard](/files/zvblR8BF8uleR0XfUQ7g)

You can pause and unpause edits at any time from the File Versions page.

![Pause/unpause controls on the File Versions page](/files/snSyyncwFWL8aTjkEJF8)

![Pause edits alert in the Rockhopper add-in](/files/w12fqCzjVes8iFzvhTiL)

## Reverting to a previous version

Need to go back to an older version of the file?

1. Open the version you want to restore from the File Versions page
2. Click the options menu (**...**) in the top navigation bar
3. Select **Revert to this version**
4. Choose a version number and explain why you're reverting

![Revert option in the version menu](/files/B4RqRQ58djCLhLVoqoXc)

![Revert to version dialog](/files/urXOn72papsKsFzdVLNw)

This creates a *new* version using the content of the selected one — the version history stays intact and the revert is fully traceable.

![Reverted version in the version history](/files/WYgOprrDbd7O3zNa3PDT)

{% hint style="info" %}
Like discarding, reverting requires pausing edits if other users are working on the file.
{% endhint %}

![Pause edits request for reverting](/files/1K6A0AWgg83vugERL7hb)

## Creating a copy from a version

You can duplicate a file from any committed version:

1. Click the options menu (**...**) on any version
2. Select **Create new file from version**
3. Edit the file name if needed (Rockhopper appends "(Copy)" by default)

![Create new file from version menu option](/files/3Gygav1bPwpYb6m86WhM)

![Create new file dialog with name field](/files/BW9XWDbhEFtsLO8BtXgg)

The new file appears in My Files as an independent file with its own version history. A copy is also created in your OneDrive or SharePoint.

![New file appearing in My Files](/files/Noxjv3y52ltJEhMcaq7a)


# Profile & Settings

## Your profile

Click your **avatar** in the top-right corner and select **Profile** to view and edit your account details.

You can update:

* **First name** and **Last name**
* **Email address**
* **Timezone** — Rockhopper auto-detects your browser timezone, but you can override it here. Timestamps throughout the app (versions, comments, change log entries) display in your chosen timezone.
* **Avatar** — Click your avatar image to upload a new photo. Images are resized to 256 x 256 pixels automatically. Maximum file size is 5 MB.

Click **Save** when you're done. The button is only enabled when you have unsaved changes.

![Profile Settings page with avatar, name, email, and timezone fields](/files/QAFMf3MTvyv6YGwn9rK7)

## Access Tokens

Access Tokens let you connect external tools — like an AI assistant or the [Postman workspace](/it-setup/mcp-postman-workspace) — to your Rockhopper account. Navigate to **Avatar → Access Tokens** or go directly to [app.rockhopper.co/settings/access-tokens](https://app.rockhopper.co/settings/access-tokens).

### Creating a token

1. Click **Create token**
2. Give the token a descriptive **name** (e.g. "Cursor MCP", "Claude Desktop")
3. Choose a **scope**:
   * **Read-only** — the token can view files, versions, comments, and reviews but cannot make changes
   * **Read-write** — the token can also post comments, open review requests, approve reviews, and update file descriptions
4. Set an **expiry** — 30, 60, 90, 180, or 365 days
5. Click **Create**

{% hint style="warning" %}
The token value is shown **only once**. Copy it immediately — Rockhopper cannot retrieve it later. The clipboard auto-clears after 30 seconds for security.
{% endhint %}

Start with **read-only** scope. Only upgrade to read-write if you have a workflow that genuinely needs write access.

### Managing tokens

![Personal Access Tokens page showing active tokens](/files/aCJ0TDCpPB8VQAyVpeJc)

The Access Tokens page shows all your active tokens with:

| Column        | What it shows                                                  |
| ------------- | -------------------------------------------------------------- |
| **Name**      | The label you gave the token                                   |
| **Token**     | A masked prefix (e.g. `rh_pat_abc1...`) — never the full value |
| **Scope**     | `read-only` or `read-write` badge                              |
| **Expires**   | When the token stops working                                   |
| **Last used** | When the token was last used to call the API                   |

### Revoking a token

Click **Revoke** next to any token to disable it immediately. A confirmation dialog appears before the token is deleted. Revoked tokens cannot be restored — you'll need to create a new one.

Revoke a token if:

* You suspect it has been exposed or compromised
* The tool or integration it was created for is no longer in use
* You want to rotate tokens as a routine security practice

{% hint style="info" %}
For web-based AI clients (Claude.ai, ChatGPT), you don't use a PAT — you sign in through Rockhopper's normal SSO flow. The gateway issues short-lived session tokens (\~30 minutes) that auto-rotate. These sessions also appear on the Access Tokens page, prefixed with `gateway:`.
{% endhint %}


# Using Rockhopper with an AI Assistant

Rockhopper exposes your spreadsheet workspace to AI assistants like **Cursor**, **Claude Desktop**, **Claude Code**, **VS Code**, **Claude.ai**, and **ChatGPT** through the [Model Context Protocol (MCP)](https://modelcontextprotocol.io). Once connected, the AI can read your enrolled files, summarize changes, surface review requests, and (with your explicit permission) post comments or open reviews on your behalf.

This page is a plain-language tour of **what your AI can do**, **what it can't do**, and **how it stays inside your permissions**. For technical setup instructions, see [MCP Server (AI Integration)](/it-setup/mcp-server). For testing the integration with a UI, see [Postman Workspace](/it-setup/mcp-postman-workspace).

## What your AI can do

The AI assistant gets sixteen "tools" it can choose to call on your behalf, plus a small set of pre-built workflows ("prompts") and read-only data sources ("resources"). Each tool is one of two flavors:

* **Read-only** — the AI can look but not touch.
* **Read-write** — the AI can also post comments, open reviews, and rename files.

You decide which flavor your AI gets when you create the Personal Access Token. Start with read-only and only upgrade if you have a workflow that genuinely needs writes.

### Read-only — what your AI can see

| Capability         | What you'll ask                                                       | What happens behind the scenes                                                           |
| ------------------ | --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| List your files    | *"Show me my Rockhopper files."*                                      | The AI calls `list_files`, returns names and types.                                      |
| Search by name     | *"Find any file with 'budget' in the name."*                          | `search_files` filters by substring.                                                     |
| Version history    | *"What versions exist of Q2 Forecast?"*                               | `get_file_versions` returns every committed snapshot with author + timestamp.            |
| Cell-level history | *"How did B10 in Sheet1 change between v1.4 and v1.7?"*               | `get_cell_history` walks the cell across versions and returns old/new values.            |
| Pending changes    | *"What's been edited in Budget.xlsx that hasn't been committed yet?"* | `get_unattributed_changes` lists live-sheet edits not yet attached to a version.         |
| Comments           | *"List the open comments on Forecast.xlsx."*                          | `get_file_comments` returns threads with author, cell anchor, replies, resolution state. |
| Review requests    | *"Are there any reviews waiting on the latest version?"*              | `get_reviews` returns requesters, reviewers, statuses.                                   |

### Read-write — what your AI can do **on your behalf**

| Capability            | What you'll ask                                                                | Effect                                                                                                 |
| --------------------- | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------ |
| Create a version      | *"Commit the current changes on Budget.xlsx as a minor version."*              | `create_version` saves uncommitted changes as a new semver version (major/minor/patch).                |
| Discard changes       | *"Discard the uncommitted changes on Forecast.xlsx — they were exploratory."*  | `discard_changes` reverts to the latest committed version. Changes are preserved in history for audit. |
| Add a comment         | *"Drop a comment on B10 saying 'check this projection'."*                      | `add_comment` posts the comment as **you**; appears in the app + emails like a normal comment.         |
| Reply in a thread     | *"Reply to Sarah's question about cell C7."*                                   | `reply_to_comment` posts a threaded reply.                                                             |
| Resolve a comment     | *"Mark the comment about labels as resolved."*                                 | `resolve_comment` closes the thread (only your own comments).                                          |
| Open a review request | *"Ask Sarah and Joe to review v1.4 of Forecast."*                              | `create_review_request` sends review-invite emails to the assignees.                                   |
| Approve a review      | *"Approve the review they sent me."*                                           | `approve_review` records your approval (only on reviews assigned to you).                              |
| Cancel a review       | *"Cancel the pending review on v1.3 — we're going to rework the assumptions."* | `cancel_review` cancels a pending review request (only the requester can cancel).                      |
| Rename a file         | *"Rename 'New Folder Copy 3.xlsx' to 'Q2 Forecast — Final'."*                  | `rename_file` updates the display name.                                                                |

### Pre-built workflows

The AI can also invoke four pre-built "prompts" that bundle several tools into a single workflow:

| Prompt                       | What it does                                                                                                          |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| **File overview**            | Pulls versions, comments, reviews, and pending changes for one file, then asks the AI to write a status report.       |
| **Summarize recent changes** | Surfaces the last five versions and twenty unattributed edits, then summarizes what changed and who made the changes. |
| **Pending reviews**          | Lists every reviewer status on the latest version and asks the AI to flag what needs attention.                       |
| **Unresolved comments**      | Filters to open comment threads only and asks the AI to prioritize follow-ups.                                        |

These show up as "/" commands in clients that support MCP prompts (like Claude Desktop and Claude Code).

## What your AI **cannot** do

This list is intentional — Rockhopper deliberately does **not** expose anything below today, and most of it never will.

| Not supported                                                | Why                                                                                                                                               |
| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| Edit a cell value in your spreadsheet                        | Editing live data from an AI surface is a different risk tier; would require a two-step user-confirmation flow. Use Excel/Google Sheets directly. |
| Enroll a new file or remove an existing one                  | Enrollment requires a Microsoft/Google OAuth handshake your AI client doesn't have access to. Enroll from the Rockhopper app.                     |
| See files outside your workspace permissions                 | The MCP server uses **your** identity. If you can't see a file in Rockhopper, your AI can't either. Period.                                       |
| Bypass review requirements                                   | Approvals only work on reviews assigned to you; same gate as the web app.                                                                         |
| Run arbitrary database queries                               | The MCP server has no direct database, S3, or Microsoft Graph access — only the Rockhopper REST API.                                              |
| See another user's PAT or session                            | PATs are user-scoped, hashed, and never returned after creation.                                                                                  |
| Read your password / personal info                           | The API never exposes credentials, billing details, or PII beyond what's already visible in the workspace UI.                                     |
| Send email outside what comments and reviews already trigger | The AI can post a comment that triggers a notification email — same email rules as if you typed it yourself.                                      |
| Make Rockhopper send Slack/Teams messages                    | We don't expose chat-platform writes.                                                                                                             |

## How permissions work — three layers of protection

1. **You hold the keys.** Your AI authenticates with a Personal Access Token (PAT) you create in **Avatar → Access Tokens**. Tokens have a name, scope (`read-only` or `read-write`), and expiry. You can revoke them instantly from the same page.
2. **Permissions follow your account.** A PAT inherits your permissions exactly. If you lose access to a workspace, your PAT loses access at the same time. Reviewer-only tools require you to be an assigned reviewer; "resolve comment" requires you to be the comment's author. Same rules as the web app.
3. **Read-only is read-only.** A PAT scoped `read-only` cannot post comments, open reviews, or rename files — even if the AI is asked to. The check happens server-side, not in your client.

For web-based AI clients (Claude.ai, ChatGPT) you don't paste a PAT — you sign in through Rockhopper's normal SSO and the gateway issues a **short-lived** session token (default 30 minutes) that auto-rotates. You can revoke active sessions from the same Access Tokens page (look for entries prefixed `gateway:`).

## Audit trail

Everything your AI does is logged the same way as actions in the web app:

* **Comments** posted by an AI show up under your name in every comment thread, in every email digest, and in the activity feed.
* **Reviews** opened by an AI show your name as the requester.
* **API calls** are recorded server-side with tool name, user id, latency, and outcome — viewable by your administrator.
* **Request and response bodies are never persisted.** We log metadata, not content.

If you're not sure whether an AI assistant did something, ask your admin to pull the API audit log for your user — every tool invocation is there.

## Recommended starter workflows

Once you're connected, try one of these to get a feel for the integration:

1. **Daily catch-up.** *"Using Rockhopper, give me a one-paragraph summary of what changed across all my files in the last 24 hours."*
2. **Review triage.** *"Are there any review requests assigned to me? Group by urgency."*
3. **Comment cleanup.** *"List unresolved comments on my files, sorted by oldest first. For any thread that hasn't had activity in 30 days, suggest a reply or resolution."*
4. **Cell-level forensics.** *"In Q2 Forecast, find any cell whose value changed by more than 10% between v1.0 and v2.0 — and tell me who made each change."*
5. **Review drafting.** *"Draft a review request for v1.4 of Forecast.xlsx, assigning Sarah and Joe, with a description noting that the revenue assumptions in column F have been updated."*

The AI client decides which tools to call based on your wording — you don't need to know the tool names.

## Frequently asked questions

**Can my AI delete data?** No. There are no delete tools in the MCP surface today. The most destructive actions are `discard_changes` (reverts uncommitted edits — but they're preserved in version history for audit) and `cancel_review` (cancels a pending review). Comment resolution and review approval are also reversible.

**Can I undo something the AI did?** Yes — via the Rockhopper app. Posted comments can be deleted by their author; resolved comments can be reopened; review requests can be cancelled.

**Does the AI see my data even when I'm not chatting with it?** Only when it actively calls a tool. The MCP server doesn't background-poll; every tool call is in response to a user prompt in your AI client.

**Is my data sent to OpenAI / Anthropic?** Whatever the AI fetches via Rockhopper tools is then visible to the AI model that processed your prompt — that's the nature of any chatbot integration. Read your AI client's data policy to understand how they handle that. Rockhopper itself does **not** send data to any LLM provider.

**Can I limit my AI to specific files?** Indirectly — by limiting which files your account is enrolled in. There's no per-file PAT scoping today; it's a planned enhancement.

**Can my admin disable the integration globally?** Yes — admins can revoke all PATs in the workspace from the Access Tokens admin page, or set the workspace flag that disables PAT creation.

## Next steps

* **Set it up.** [Install the MCP server in your AI client →](/it-setup/mcp-server)
* **Test it manually.** [Try the Postman workspace →](/it-setup/mcp-postman-workspace)
* **Understand the security posture.** [Read the data governance summary →](/security-and-compliance/data-governance)

Questions? Email <support@rockhopper.co>.


# Overview

Rockhopper is a version control and collaboration platform for spreadsheets, built for finance and accounting teams that work with sensitive financial data every day. Security, data integrity, and privacy are foundational to how the platform is designed and operated.

## Security principles

**Minimal data access.** Rockhopper only requests the permissions necessary to read and write the files you choose to enroll. We don't scan, index, or analyze spreadsheet contents beyond what's needed for change tracking.

**Encryption everywhere.** All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Authentication tokens are held in memory only — never persisted.

**Isolation by design.** Production and staging environments are fully separated at the network level. Each infrastructure component runs with its own firewall rules and the minimum required exposure.

**Audit-ready.** Every data mutation is logged with the acting user's identity, the resource affected, and a timestamp. This audit trail supports SOC 2 compliance requirements.

**No credential storage.** Rockhopper delegates all authentication to Microsoft Entra ID (Azure AD) and Google Identity. We never store user passwords or authentication credentials.

## Compliance

Rockhopper has completed a **SOC 2 Type II** audit covering the **Security** and **Confidentiality** trust service categories. The examination was performed by Laika Compliance LLC for the period January 1 -- June 30, 2025 and resulted in an **unqualified (clean) opinion with no exceptions**.

Our security controls, data handling practices, and operational procedures are independently verified against the AICPA Trust Services Criteria. We also conduct annual independent penetration testing and maintain a formal Information Security Policy that is reviewed and approved annually.

The full SOC 2 Type II report is available to current and prospective customers under NDA. Contact <privacy@rockhopper.co> to request a copy.

## What's in this section

| Page                                                                    | What it covers                                                                            |
| ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| [System Architecture](/security-and-compliance/architecture)            | Platform components, cloud infrastructure, and integration approach                       |
| [Data Governance](/security-and-compliance/data-governance)             | What data we store, how long we keep it, and how to request export or deletion            |
| [Encryption](/security-and-compliance/encryption)                       | How data is protected in transit and at rest                                              |
| [Network Security](/security-and-compliance/network-security)           | Network isolation, SSL/TLS, and web application firewall                                  |
| [Access Control](/security-and-compliance/access-control)               | Infrastructure access, application-level authorization, and audit logging                 |
| [Monitoring & Backup](/security-and-compliance/monitoring-backup)       | Logging, alerting, backup strategy, and disaster recovery                                 |
| [Microsoft Permissions](/security-and-compliance/microsoft-permissions) | Exact API permissions requested and why                                                   |
| [Trust & Verification](/security-and-compliance/trust-and-verification) | SOC 2 attestation, penetration testing, vulnerability management, and security governance |

## Contact

| Purpose                        | Email                   |
| ------------------------------ | ----------------------- |
| Security and privacy inquiries | <privacy@rockhopper.co> |
| General support                | <support@rockhopper.co> |


# System Architecture

Rockhopper is a cloud-hosted SaaS platform that integrates with Microsoft 365 and Google Workspace to provide version control and collaboration for spreadsheets. The system is designed with security isolation, least-privilege access, and defense in depth.

## Platform components

| Component                    | Purpose                                                                                     |
| ---------------------------- | ------------------------------------------------------------------------------------------- |
| **Web application**          | Browser-based interface for managing files, viewing change diffs, commenting, and reviewing |
| **Excel add-in**             | Runs within Microsoft Excel (desktop and web) to track changes in real time                 |
| **Google Sheets sidebar**    | Runs within Google Sheets to track changes in real time                                     |
| **API server**               | Processes all business logic, authentication, authorization, and data operations            |
| **Background job processor** | Handles change attribution and file synchronization asynchronously                          |
| **Database**                 | Stores user accounts, file metadata, version history, comments, and review records          |
| **Object storage**           | Stores spreadsheet version snapshots                                                        |
| **Real-time server**         | WebSocket server for live updates between concurrent users                                  |

## Cloud infrastructure

All infrastructure is hosted on **Amazon Web Services (AWS)**:

* Compute, networking, and storage are managed entirely within AWS
* Production and staging environments are isolated in separate VPCs with no cross-environment access
* Database clusters run in high-availability configurations with automatic failover
* Object storage uses S3 with 99.999999999% (11 nines) durability for version snapshots
* Secrets and credentials are managed via AWS Secrets Manager with KMS encryption

![Rockhopper cloud architecture diagram showing test and production environments on AWS](/files/qQzTtihQgXICojCoF32m)

## Integration approach

### Microsoft 365

Rockhopper connects to Microsoft 365 tenants via **Microsoft Entra ID** (Azure AD):

* Users authenticate via industry-standard OAuth 2.0 / OpenID Connect
* File access uses the Microsoft Graph API with delegated permissions scoped to the signed-in user
* Only the minimum required permissions are requested (see [Microsoft Permissions](/security-and-compliance/microsoft-permissions))
* No Microsoft credentials are stored — authentication tokens are held in memory only

### Google Workspace

Rockhopper connects to Google Workspace via **Google Identity**:

* Users authenticate via Google OAuth 2.0
* File access uses the Google Drive and Sheets APIs with delegated permissions
* Refresh tokens are encrypted and stored securely in the database

## Data flow

When a user edits an enrolled spreadsheet:

1. The add-in or sidebar detects the change via platform APIs (Office.js or Google Apps Script)
2. The change event is reported to the Rockhopper API server
3. The backend records the change and runs a background job to attribute it to the specific user
4. Attributed changes appear in the web application's change log and diff view
5. When the user creates a new version, the backend downloads the current file, stores a snapshot, and mints a semantic version number


# Data Governance

## What data does Rockhopper store?

Understanding exactly what data Rockhopper holds is important for any security evaluation. Here's a clear breakdown:

### Data Rockhopper stores

| Data type             | What it includes                                                  | Purpose                                         |
| --------------------- | ----------------------------------------------------------------- | ----------------------------------------------- |
| **User profile**      | Name and email address (sourced from Microsoft or Google account) | Identify users, display names, enable @mentions |
| **Team membership**   | Which users belong to which teams, and their roles                | Access control and collaboration                |
| **File metadata**     | File names, drive/file IDs, enrollment timestamps                 | Track which files are managed by Rockhopper     |
| **Version snapshots** | Point-in-time copies of enrolled spreadsheets                     | Enable version comparison and revert            |
| **Change records**    | Which cells changed, old/new values, who made the change, when    | Change tracking and audit trail                 |
| **Comments**          | Comment text, author, timestamps, version associations            | Team collaboration                              |
| **Review records**    | Review requests, reviewer assignments, approval status            | Formal review workflow                          |
| **Activity logs**     | Who did what and when (audit trail)                               | SOC 2 compliance and traceability               |

### Data Rockhopper does NOT store

* **User passwords or credentials** — Authentication is fully delegated to Microsoft or Google
* **Email, calendar, or contacts** — Rockhopper only accesses files, not other Microsoft 365 or Google Workspace data
* **Spreadsheet contents beyond change tracking** — Rockhopper does not index, search, or analyze the contents of your files

## Data classification

Rockhopper classifies all data into three tiers to ensure appropriate handling, storage, and access controls:

| Classification   | Description                                                                     | Examples                                                                          |
| ---------------- | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
| **Sensitive**    | The most restricted data, with access strictly limited                          | Passwords, encryption keys, authentication tokens                                 |
| **Confidential** | Business information intended for use solely by Rockhopper and/or its customers | Personally identifiable information (PII), customer financial data, audit reports |
| **Public**       | Information that does not fit into the above classifications                    | Marketing content, published documentation                                        |

Each tier has specific requirements for storage, transmission, access control, and disposal. The classification policy is reviewed annually by management.

## Non-production environments

Customer data is **prohibited from use in development and test environments** by policy. Production and non-production environments are segregated at the network level, and all production data is sanitized before any use in non-production contexts.

## Data retention

Data is maintained for the duration of the contractual agreement with your organization:

* **Version snapshots** are retained indefinitely (including discarded and reverted versions) to preserve the audit trail
* **Comments and reviews** are retained for the life of the file
* **User accounts** persist until the organization requests removal

At the end of a contract, all data associated with your organization is purged.

## Data export

You can request a full export of your organization's data at any time. Contact <privacy@rockhopper.co> and we'll provide the export within one week.

## Data deletion

Rockhopper can perform a complete purge of specified accounts or data upon request. Contact <privacy@rockhopper.co> to initiate. After an export is provided, all associated data is purged within 24 hours.

## Secure disposal

When data reaches the end of its retention period or is no longer required, Rockhopper securely disposes of it using industry-accepted methods for secure deletion. All disposal actions are tracked through a ticketing system to maintain a documented chain of custody.

## Personal data protection

Rockhopper collects only the personal information necessary for operation — names and email addresses from your identity provider. The platform does not collect or store personal data outside this scope.


# Encryption

## Data in transit

All communication between clients and Rockhopper is encrypted with TLS 1.2 or higher. Unencrypted connections are never accepted.

| Channel               | Protocol                      |
| --------------------- | ----------------------------- |
| Web application       | HTTPS (TLS 1.2+)              |
| Excel add-in          | HTTPS (TLS 1.2+)              |
| Google Sheets sidebar | HTTPS (TLS 1.2+)              |
| Real-time updates     | WSS (TLS-encrypted WebSocket) |
| Microsoft Graph API   | HTTPS (TLS 1.2+)              |
| Google APIs           | HTTPS (TLS 1.2+)              |

SSL certificates are managed and renewed automatically. All HTTP requests are redirected to HTTPS.

![SSL certificate details for \*.rockhopper.co](/files/goEXQOuqidE0fZGVm0yC)

## Data at rest

All persistent data is encrypted using AWS-managed encryption services:

| Storage layer           | Encryption                                   |
| ----------------------- | -------------------------------------------- |
| Database (PostgreSQL)   | AWS RDS encryption with AES-256              |
| Version snapshots (S3)  | Server-side encryption (SSE-S3) with AES-256 |
| Secrets and credentials | AWS Secrets Manager with KMS                 |

![S3 bucket encryption settings showing SSE-S3 with AES-256](/files/vvu5ohyuqG5P1H4j5BoF)

## Authentication tokens

Rockhopper uses OAuth 2.0 for authentication with Microsoft Entra ID and Google Identity. Microsoft access tokens are:

* Held in memory only during the user's active session
* Never persisted to disk, database, or browser storage by Rockhopper
* Transmitted exclusively over encrypted channels

Google OAuth refresh tokens are encrypted and stored in the database to maintain persistent file access for change tracking.


# Network Security

## Network isolation

Rockhopper's infrastructure follows strict network segmentation principles:

* **Environment separation** — Production and staging environments are isolated in separate VPCs. No cross-environment access is permitted.
* **Minimal exposure** — Each component has its own firewall rules, exposing only the ports and protocols required for its function.
* **Private subnets** — Databases, background processors, and internal services are placed in private subnets with no direct internet access. Only the API server and web application are internet-facing.

## TLS enforcement

All internet-facing connections require TLS 1.2 or higher:

* Client-to-server traffic uses HTTPS exclusively
* WebSocket connections use WSS (encrypted WebSocket)
* Internal service-to-service communication follows AWS security group rules within the VPC
* Unencrypted HTTP requests are automatically redirected to HTTPS

## Web Application Firewall

A WAF is deployed across the entire cloud footprint, providing protection against:

* **Injection attacks** — SQL injection, cross-site scripting (XSS), and other common web exploits
* **Volumetric attacks** — DDoS mitigation and rate limiting
* **Malicious patterns** — Automated scanning and known attack signatures


# Access Control

## Infrastructure access

### Credential management

All sensitive keys and credentials are stored in **AWS Secrets Manager** and accessed at runtime by authorized service instances only. No credentials exist in source code, configuration files, or environment files committed to version control.

### IAM role separation

Access to AWS infrastructure is governed by IAM roles with strict separation of duties:

| Scope                              | Who has access                                                     |
| ---------------------------------- | ------------------------------------------------------------------ |
| **Production data and services**   | Company CTO only, plus service-to-service IAM roles                |
| **Staging and development**        | Development team (for testing and debugging)                       |
| **Production monitoring and logs** | Development team (read-only — no access to production data stores) |

### Multi-factor authentication

Access to production infrastructure requires a valid multi-factor authentication (MFA) token. MFA is enforced for all privileged access to cloud consoles, servers, and data stores.

## Application-level access control

### Authentication

All users authenticate via **Microsoft Entra ID** (Azure AD) or **Google Identity** using industry-standard OAuth 2.0. Rockhopper does not maintain its own authentication system — credentials are never stored or managed by the platform.

### Authorization

Every API request is authorized against the user's team membership and role before any data is returned or modified:

* **Team-scoped** — Users can only access files and data belonging to teams they are members of. There is no cross-team data visibility.
* **Role-based** — Admin, Manager, and Contributor roles determine what actions a user can perform (e.g., inviting members, dismissing reviews).
* **File-scoped** — Individual file access is verified on every request through dedicated access guards.

No API endpoint is accessible without authentication and authorization checks.

### Quarterly access reviews

All employee access to production systems is reviewed by management at least quarterly. Reviews verify that each user's access is appropriate for their current role and complies with the principles of least privilege and separation of duties. Results are documented, and access is modified or removed where applicable.

### Employee lifecycle

Access provisioning and deprovisioning follow formal procedures:

* **Provisioning** — Access to systems is granted based on job role and requires a documented request with manager approval before access is provided. Users are assigned unique identifiers and must acknowledge company policies before receiving access.
* **Deprovisioning** — When an employee is terminated, access to all systems is revoked within **24 hours** of termination.

### Audit logging

All data mutations — creating, updating, and deleting records — are logged with:

* The acting user's identity
* The resource type and ID affected
* A timestamp

This audit trail is maintained for SOC 2 compliance and is available for forensic review.


# Monitoring & Backup

## Logging and monitoring

Rockhopper uses centralized logging and real-time monitoring across all systems:

| System                              | Purpose                                                                                                                                           |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| **AWS CloudWatch**                  | Centralized application log aggregation, search, and analysis                                                                                     |
| **AWS CloudWatch Metrics & Alarms** | Real-time monitoring of traffic, API response times, error rates, and database performance — with automatic alerting when thresholds are exceeded |
| **AWS CloudTrail**                  | Security monitoring and audit logging of API activity across the AWS environment                                                                  |
| **Intrusion detection**             | Continuous monitoring of network activity for anomalous behavior and early detection of potential security breaches, with automated alerting      |
| **Threat detection**                | Automated analysis of cloud activity for malicious behavior, unauthorized access attempts, and compromised resources                              |
| **Sentry**                          | Real-time error tracking and alerting for application exceptions                                                                                  |
| **Anti-malware**                    | Deployed on applicable infrastructure, automatically updated, and configured for periodic scanning                                                |

All logs are retained according to AWS CloudWatch retention policies and are accessible only to authorized personnel. Logs never contain authentication tokens, credentials, or other restricted data.

## Incident response

Rockhopper maintains a formal Incident Response Plan that defines procedures for detecting, responding to, and recovering from security events and incidents. The incident response plan is **tested annually** through tabletop exercises to validate readiness. Post-incident reviews are conducted after any significant operational issue to capture root causes and drive preventive improvements.

## Backup and recovery

### Version snapshots

Spreadsheet version snapshots are stored in **Amazon S3** with highly durable storage classes, providing **99.999999999%** (11 nines) durability. Each committed version is an immutable snapshot that cannot be overwritten.

### Database backups

| Protection layer           | Details                                                                              |
| -------------------------- | ------------------------------------------------------------------------------------ |
| **Daily snapshots**        | Automated daily backups of all database clusters                                     |
| **Point-in-time recovery** | Continuous backup with the ability to restore to any second within the last 24 hours |
| **High availability**      | Production databases run in multi-AZ configurations with automatic failover          |

### Backup retention

All backups are stored in a secure remote location and retained for **60 days**. Backups are tested annually by the engineering team to verify they can be restored and meet defined recovery time requirements.

### Disaster recovery

Rockhopper maintains a documented **Business Continuity and Disaster Recovery (BC/DR) Plan** that is tested annually through simulated service disruptions. Test results are documented and used to improve recovery procedures.

In the event of a service disruption:

* Database failover to a standby replica is automatic
* Version snapshots in S3 are replicated across multiple availability zones
* Application services can be redeployed from infrastructure-as-code definitions


# Microsoft Permissions

Rockhopper integrates with Microsoft 365 via Microsoft Entra ID (Azure AD) and the Microsoft Graph API. This page documents the exact permissions requested and explains why each is needed.

## Permissions requested

| Permission              | Type      | Why Rockhopper needs it                                                                                                     |
| ----------------------- | --------- | --------------------------------------------------------------------------------------------------------------------------- |
| **Files.Read.All**      | Delegated | Read files the user can access — used to detect changes to enrolled spreadsheets and download version snapshots             |
| **Files.ReadWrite.All** | Delegated | Read and write files the user can access — used to update files when reverting to a previous version or creating a copy     |
| **User.Read**           | Delegated | Read the signed-in user's profile — used to identify the user and display their name and email in Rockhopper                |
| **User.ReadBasic.All**  | Delegated | Read basic profile info for all users in the organization — used to show team member names and enable @mentions in comments |

All permissions are **delegated**, meaning they operate within the context of the signed-in user. Rockhopper can only access files and profiles that the user themselves already has access to in Microsoft 365.

## What Rockhopper does NOT access

| Category                       | Details                                                                                                    |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------- |
| **Email and calendar**         | No access to mailboxes, calendars, or contacts                                                             |
| **Teams and chat**             | No access to Microsoft Teams messages, channels, or meetings                                               |
| **SharePoint lists and sites** | No access beyond OneDrive/SharePoint file storage                                                          |
| **Admin functions**            | No admin-level permissions — Rockhopper cannot modify tenant settings, user accounts, or security policies |

## How permissions are granted

During initial onboarding, a Microsoft 365 administrator grants consent for these permissions on behalf of the organization. This is a one-time process — see the [Microsoft 365 Onboarding](/it-setup/tenant-onboarding) guide for step-by-step instructions.

Individual users do not need to grant additional permissions. Once admin consent is provided, all users in the tenant can sign into Rockhopper and begin using the platform.


# Trust & Verification

This page summarizes the independent assessments, formal policies, and security programs that govern how Rockhopper protects your data. It is intended for IT and security professionals conducting vendor due diligence.

## SOC 2 Type II attestation

Rockhopper has completed a SOC 2 Type II examination covering the **Security** and **Confidentiality** trust service categories.

| Detail                       | Value                                                              |
| ---------------------------- | ------------------------------------------------------------------ |
| **Auditor**                  | Laika Compliance LLC (Arlington, Virginia)                         |
| **Audit period**             | January 1 -- June 30, 2025                                         |
| **Trust service categories** | Security, Confidentiality                                          |
| **Opinion**                  | Unqualified (clean) -- no exceptions noted                         |
| **Subservice organization**  | AWS (carved out; Rockhopper reviews the AWS SOC 2 report annually) |

The audit evaluated the design and operating effectiveness of controls across the AICPA Trust Services Criteria, including control environment, risk assessment, monitoring, logical access, system operations, change management, and confidentiality.

**Requesting the report.** The full SOC 2 Type II report is available to current and prospective customers under NDA. Contact <privacy@rockhopper.co> to request a copy.

## Penetration testing

Rockhopper engages an independent, qualified third party to perform penetration testing at least annually.

* Testing follows a **gray-box methodology** based on the OWASP Web Security Testing Guide (WSTG)
* Both the web application and API are in scope
* The testing firm validates that the staging environment mirrors production before testing
* All identified findings are remediated and **retested by the penetration tester** to confirm resolution
* The most recent test was completed in **2025** with all findings remediated and verified

An executive summary of the most recent penetration test is available to prospective customers under NDA. Contact <privacy@rockhopper.co> to request it.

## Vulnerability management

Rockhopper operates a continuous vulnerability management program to identify, prioritize, and remediate security risks.

**Continuous scanning.** Internal and external vulnerability scans run continuously across production infrastructure. Results are reviewed by the engineering and security teams.

**Severity-based remediation SLAs.** Vulnerabilities are classified using the OWASP Risk Rating Methodology and remediated within defined timelines:

| Severity     | Remediation timeline  |
| ------------ | --------------------- |
| Critical     | Immediately to 7 days |
| High         | Within 14 days        |
| Medium / Low | Within 30 days        |

**Patch management.** Infrastructure patches are deployed at least monthly. Critical and zero-day patches are escalated and applied as soon as possible, following an impact assessment.

**Anti-malware.** Endpoint and server anti-malware solutions are deployed, automatically updated, and configured for periodic scanning.

## Security governance

Rockhopper maintains a formal **Information Security Policy** that is reviewed and approved by management at least annually. The policy covers ten security domains:

1. Security Organization and Management
2. Risk Management
3. People Security
4. Access Control
5. Network and System Security
6. Vulnerability Management
7. Monitoring
8. Change Management
9. Incident Management
10. Vendor Management

### Risk oversight

A **Risk Committee** with at least one independent member provides governance and oversight of the security program. The committee meets quarterly, maintains formal meeting minutes, and is responsible for approving the Information Security Policy and overseeing the annual risk assessment.

### Annual risk assessment

A formal risk assessment is conducted at least annually, or when significant changes occur. The assessment identifies threats and vulnerabilities, rates their likelihood and impact, and informs the selection of controls and mitigation strategies. Fraud risk is explicitly considered as part of the process.

## Incident response

Rockhopper maintains a documented **Incident Response Plan** that defines procedures for detecting, containing, remediating, and communicating security incidents.

* An Incident Response Team (IRT) with defined roles and responsibilities leads the response process
* The incident response plan is **tested annually** through tabletop exercises
* Post-incident reviews are conducted after any significant operational issue to identify root causes and preventive actions
* Customers and authorities are notified when required

## Business continuity and disaster recovery

Rockhopper maintains a documented **Business Continuity and Disaster Recovery (BC/DR) Plan** that is tested annually through simulated service disruptions.

| Measure                    | Detail                                                                           |
| -------------------------- | -------------------------------------------------------------------------------- |
| **Database backups**       | Automated daily backups with point-in-time recovery                              |
| **Backup retention**       | 60 days                                                                          |
| **High availability**      | Multi-AZ database configuration with automatic failover                          |
| **Version snapshots**      | Stored in S3 with 99.999999999% durability, replicated across availability zones |
| **Infrastructure as code** | Services can be redeployed from version-controlled definitions                   |

BC/DR test results are documented, and findings are used to improve recovery procedures and assess performance against defined KPIs.

## Employee security

Rockhopper enforces security requirements throughout the employee lifecycle:

* **Background checks** are performed on all individuals prior to their start date
* **Confidentiality agreements** must be signed before access to any company systems is granted
* **Security awareness training** is completed within 30 days of hire and at least annually thereafter, covering threat identification, phishing, incident reporting, and data protection
* **Performance reviews** are conducted at least annually by managers
* **Access deprovisioning** is completed within 24 hours of termination

## Change management

All changes to production systems follow a controlled change management process:

* Changes are developed in environments segregated from production
* All code changes undergo peer review by a second engineer
* Automated testing validates changes before deployment
* A staging environment that mirrors production is used for final validation
* Major changes require CTO approval
* Failed deployments are automatically rolled back
* All changes are tracked in version control with full audit history

## Vendor management

Rockhopper assesses and manages risks from third-party vendors through a formal vendor management program:

* Vendors are assigned a **criticality rating** (Critical, High, Medium, Low) based on operational dependency, business impact, and relevance to the software product
* **Formal agreements** are in place with all critical vendors, including commitments to information security standards
* **Annual reviews** of SOC 2 or equivalent attestation reports are conducted for all vendors rated critical or high risk, with exceptions evaluated for impact on the service
* AWS, the primary infrastructure provider, is reviewed annually and its SOC 2 report is assessed for any exceptions relevant to Rockhopper's service

## Requesting reports and completing questionnaires

Rockhopper is happy to support your vendor evaluation process. The following are available upon request:

| Document                           | Availability |
| ---------------------------------- | ------------ |
| SOC 2 Type II report               | Under NDA    |
| Penetration test executive summary | Under NDA    |
| Security questionnaire completion  | On request   |

Contact <privacy@rockhopper.co> for any of the above or for additional security questions.


# Prerequisites

Before setting up Rockhopper for your organization, make sure you have the following ready.

## For Microsoft 365 organizations

| Requirement       | Details                                                                                   |
| ----------------- | ----------------------------------------------------------------------------------------- |
| **Admin account** | A Microsoft 365 account with Global Administrator or Application Administrator privileges |
| **Tenant ID**     | Your organization's Microsoft 365 tenant identifier (see below)                           |
| **Time**          | Allow 15–20 minutes to complete the onboarding process                                    |

### Finding your Microsoft 365 tenant ID

1. Go to [portal.azure.com](https://portal.azure.com) and sign in with your admin account
2. Click **Manage Microsoft Entra ID** on the home page
3. Your **Tenant ID** is displayed on the overview page

![Azure portal showing the Tenant ID on the Microsoft Entra ID overview page](/files/bTz0eNXNEAzk8AaAvvyl)

## For Google Workspace organizations

| Requirement       | Details                                                |
| ----------------- | ------------------------------------------------------ |
| **Admin account** | A Google Workspace account with Super Admin privileges |
| **Time**          | Allow 10–15 minutes to complete the onboarding process |

## General notes

* Stay logged in with the admin account throughout the onboarding process
* Complete all steps in a single session for the smoothest experience
* If you have custom integration requirements, contact your Rockhopper Account Manager before starting


# Microsoft 365 Onboarding

This guide walks through connecting your Microsoft 365 tenant to Rockhopper. The process has three steps and takes about 15 minutes.

## Step 1: Approve the Azure app permissions

Construct the admin consent URL by replacing `tenant-id` with your actual tenant ID (see [Prerequisites](/it-setup/prerequisites)):

```
https://login.microsoftonline.com/tenant-id/v2.0/adminconsent?client_id=4fea1907-8080-44e1-8b4f-c6ce31563ac9&redirect_uri=https%3A%2F%2Fapp.rockhopper.co&scope=https://graph.microsoft.com/Files.Read.All%20https://graph.microsoft.com/Files.ReadWrite.All%20https://graph.microsoft.com/User.ReadBasic.All
```

1. Open the URL in your browser
2. Sign in with your admin account
3. Review the listed permissions and click **Accept**

![Azure admin consent screen showing the permissions Rockhopper requests](/files/IIDWbL2FC4oFfGiqltAD)

4. You'll be redirected to the Rockhopper homepage

{% hint style="info" %}
For details on what each permission does, see [Microsoft Permissions](/security-and-compliance/microsoft-permissions).
{% endhint %}

## Step 2: Sign into Rockhopper with admin consent

1. Go to [app.rockhopper.co](https://app.rockhopper.co) and click **Sign in with Microsoft**

![Rockhopper sign-in page](/files/ERxRIlcGKkUIRrRxeqQU)

2. On the permissions screen, check **Consent on behalf of your organization**
3. Click **Accept**

![Microsoft permissions screen with the "Consent on behalf of your organization" checkbox checked](/files/XlwEjOm9RneltDhAyoEB)

4. You'll be directed to an invite code screen — skip this for now

## Step 3: Grant server-side API permissions

This grants the backend API permissions that Rockhopper needs for background processing (like downloading files for version snapshots):

1. Go to [portal.azure.com](https://portal.azure.com)
2. Click **Manage Microsoft Entra ID** > **Manage**
3. Click **Enterprise Applications**
4. Find and select **Rockhopper Inc.**
5. Click **Security** > **Permissions**
6. Click **Grant admin consent for Rockhopper Inc.**

![Rockhopper Inc. permissions page in Azure Enterprise Applications](/files/IIAwX2E0Ad4saOuR88ro)

7. Review and accept the permissions in the consent modal

![Azure consent modal showing the full list of permissions requested](/files/czuSLZhOZnb6pAZrWjf8)

## Done

Your Microsoft 365 tenant is now connected to Rockhopper. Visit [app.rockhopper.co](https://app.rockhopper.co), enter your invite code, and start enrolling files and inviting team members.

**Next step:** [Deploy the Excel Add-in](/it-setup/excel-addin-deployment) to your users.


# Google Workspace Onboarding

This guide walks through connecting your Google Workspace organization to Rockhopper. The process is straightforward and takes about 10 minutes.

## Step 1: Sign into Rockhopper with Google

1. Go to [app.rockhopper.co](https://app.rockhopper.co)
2. Click **Sign in with Google**
3. Authenticate with your Google Workspace admin account
4. Review the requested permissions and click **Allow**
5. Enter your invite code when prompted

## Step 2: Authorize Google Drive access

After signing in, Rockhopper will request permission to access Google Drive files on behalf of your users. This is required for:

* Reading enrolled Google Sheets files to detect changes
* Downloading file snapshots for version control
* Creating file copies when users use the "Create new file from version" feature

The permissions are scoped to the files each user can already access — Rockhopper cannot see files outside a user's existing Google Drive permissions.

## Step 3: Deploy the Google Sheets sidebar (optional)

For real-time change tracking within Google Sheets, users can install the Rockhopper Google Sheets Add-on:

1. Open any Google Sheet
2. Go to **Extensions** > **Add-ons** > **Get add-ons**
3. Search for **Rockhopper** and click **Install**
4. Grant the requested permissions

{% hint style="info" %}
Google Workspace admins can pre-approve and deploy the add-on for all users via the Google Workspace Admin Console under **Apps** > **Google Workspace Marketplace apps**.
{% endhint %}

## Done

Your Google Workspace is now connected to Rockhopper. Users can sign in with their Google accounts, enroll Google Sheets files, and begin tracking changes.

For organizations that use both Microsoft 365 and Google Workspace, users can connect both accounts and manage files from either platform within the same Rockhopper workspace.


# Excel Add-in Deployment

After connecting your Microsoft 365 tenant, deploy the Rockhopper Excel Add-in so users can track changes directly within Excel.

## Install from AppSource

1. Go to the [Rockhopper Add-in on AppSource](https://appsource.microsoft.com/en-us/product/office/WA200006846?tab=Overview)
2. Sign in with your admin account
3. Click **Get it now**

![Rockhopper listing on Microsoft AppSource](/files/03hxtrcvPDo590QuULt6)

4. You'll be redirected to the **M365 Admin Center**

![AppSource redirecting to M365 Admin Center](/files/RKzbi4LqxjfIhENRHKX6)

{% hint style="info" %}
Only users with an Admin role are redirected to the Admin Center. Non-admin users will see a different experience.
{% endhint %}

## Choose who gets the add-in

Select which users will receive the add-in. We recommend **Entire organization** for most deployments.

![M365 Admin Center user selection — "Entire organization" selected](/files/ICkZRu7JgX39RzBSmWCe)

| Option                    | When to use it                                                                           |
| ------------------------- | ---------------------------------------------------------------------------------------- |
| **Entire Organization**   | Recommended for most deployments — all current and future users get access automatically |
| **Specific users/groups** | Use for pilot programs or phased rollouts                                                |

## Accept permissions

Click **Accept permissions** when prompted. Review the permissions the add-in needs to function within Excel.

![M365 Admin Center showing the add-in permissions to accept](/files/1wXO1syQotbVQvyxHs9J)

A consent modal will appear — review and click **Accept**.

![Microsoft consent modal for add-in permissions](/files/ZIThdpTHMKeijSfwU562)

## Finish deployment

Review the deployment summary and click **Finish deployment**.

![Deployment review screen showing "Finish deployment" button](/files/tV4ZrIP9JvOk9bZr3k9B)

You'll see a confirmation that the deployment is complete.

![Deployment completed confirmation in M365 Admin Center](/files/WDUTVOU99FWVMDyapbjE)

## Verification

After deployment, the Rockhopper add-in is available from the **Home** ribbon tab in Excel.

{% hint style="warning" %}
It can take up to 24 hours for the add-in to appear for all users. If someone doesn't see it right away, restarting Excel usually resolves it.
{% endhint %}


# MCP Server (AI Integration)

**Audit, collaborate, version, and approve your spreadsheet work — directly from Claude.** Trace every cell edit back to its author and run formal approval workflows without opening the file. The Rockhopper MCP server makes Rockhopper a native part of your AI workflow — an AI-native analyst that keeps every edit attributed, every review approved, and every workbook SOC 2-grade trustworthy.

Once connected, your AI tools — Cursor, Claude Desktop, Claude Code, VS Code, Claude.ai on the web, and ChatGPT — can talk to your Rockhopper workspace using the [Model Context Protocol](https://modelcontextprotocol.io). All access is scoped to what your Rockhopper account is allowed to see.

### Example prompts

Once the MCP server is connected, you can ask Claude things like:

* **Audit cell-level history:** *"Who last changed C12 in the P\&L Model, and what was it before?"*
* **Review uncommitted changes:** *"Show me every unattributed change in the Q3 budget this week and who made them."*
* **Comment and collaborate inline:** *"Add a comment on Sheet1!B5 asking the analyst why this assumption shifted 10%."*
* **Run formal approval workflows:** *"Create a review request for the latest version of the Q3 forecast."*
* **Approve, cancel, or chase reviews:** *"List my pending review requests, then approve the one for the budget model."*
* **Version, snapshot, or roll back:** *"Create a new version called 'pre-board-edit', then discard uncommitted changes on the Q3 forecast."*

Rockhopper offers two ways to connect, and you can mix and match:

| Deployment          | Who it's for                                                   | Transport               | Install                               |
| ------------------- | -------------------------------------------------------------- | ----------------------- | ------------------------------------- |
| **Local (npm)**     | IDE-based tools (Cursor, Claude Desktop, Claude Code, VS Code) | stdio                   | `npx @rockhopper-co/mcp-server`       |
| **Remote (hosted)** | Web clients that only support remote MCP (Claude.ai, ChatGPT)  | Streamable HTTP + OAuth | Paste `https://mcp.rockhopper.co/mcp` |

{% hint style="info" %}
The remote gateway is gated by a feature flag during GA rollout. If your workspace doesn't see the remote option yet, use the local install — the tools are identical.
{% endhint %}

{% hint style="success" %}
Prefer to test from a UI before wiring up an AI client? See [MCP — Postman Workspace](/it-setup/mcp-postman-workspace) for a click-through guide that exercises every tool, resource, and prompt — or jump straight in:

[![Run In Postman](https://run.pstmn.io/button.png)](https://god.gw.postman.com/run-collection/54299481-0b80e147-9f26-4fe5-8a87-a5dcc4a993bc?action=collection%2Ffork\&source=rip_markdown\&collection-url=entityId%3D54299481-0b80e147-9f26-4fe5-8a87-a5dcc4a993bc%26entityType%3Dcollection%26workspaceId%3Dfd36303d-a194-4e6e-978a-3b159249ec65)
{% endhint %}

## Prerequisites

* An active Rockhopper account with access to at least one workspace.
* Node.js 20+ on the machine running the AI client (only for the local install).
* Permission from your IT admin to install the MCP client you plan to use.

## Step 1 — Create a Personal Access Token (PAT)

A PAT is the credential your AI client uses to authenticate to Rockhopper. PATs are tied to **you**, inherit your workspace permissions, and never grant access beyond what you can already see in the Rockhopper app.

1. Sign in at [app.rockhopper.co](https://app.rockhopper.co).
2. Click your avatar (top right) → **Access Tokens**.
3. Click **Create token**.
4. Fill in:
   * **Name** — something memorable (e.g. `Cursor on MacBook`, `Claude Desktop`).
   * **Scope** — `read-only` lets the AI list files, read changes, and read comments. `read-write` additionally lets it post comments and open review requests. Start with `read-only` unless you have a reason to grant writes.
   * **Expires in** — 30 / 60 / 90 / 180 / 365 days. Shorter is safer.
5. Click **Create**. The full token (`rh_pat_…`) is shown **once**. Copy it immediately — Rockhopper stores only a hash; you can't recover it later.

{% hint style="warning" %}
Treat PATs like passwords. Don't paste them into chat messages, commit them to Git, or share them over email. If a PAT leaks, revoke it from the same page — the effect is instant.
{% endhint %}

## Step 2 (Option A) — Local install with `npx`

This path runs `@rockhopper-co/mcp-server` on your own machine and talks to Rockhopper over stdio. It's the simplest setup and what we recommend for IDE-based tools.

### Cursor

Open **Cursor Settings → MCP → Add new MCP server** and paste:

```json
{
  "mcpServers": {
    "rockhopper": {
      "command": "npx",
      "args": ["-y", "@rockhopper-co/mcp-server"],
      "env": {
        "ROCKHOPPER_TOKEN": "rh_pat_your_token_here"
      }
    }
  }
}
```

Save, then in a new chat confirm the **rockhopper** server appears in the MCP picker.

### Claude Desktop

Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):

```json
{
  "mcpServers": {
    "rockhopper": {
      "command": "npx",
      "args": ["-y", "@rockhopper-co/mcp-server"],
      "env": {
        "ROCKHOPPER_TOKEN": "rh_pat_your_token_here"
      }
    }
  }
}
```

Fully quit and relaunch Claude Desktop. You should see the Rockhopper tools in the tool picker.

### Claude Code

```bash
claude mcp add rockhopper \
  --env ROCKHOPPER_TOKEN=rh_pat_your_token_here \
  -- npx -y @rockhopper-co/mcp-server
```

Claude Code will pick up the server on the next session.

### VS Code (GitHub Copilot Chat / Continue / other MCP-aware extensions)

Create or edit `.vscode/mcp.json` in the workspace:

```json
{
  "servers": {
    "rockhopper": {
      "command": "npx",
      "args": ["-y", "@rockhopper-co/mcp-server"],
      "env": {
        "ROCKHOPPER_TOKEN": "rh_pat_your_token_here"
      }
    }
  }
}
```

### Self-hosted Rockhopper

If your company runs Rockhopper at a custom domain, override the API URL:

```json
{
  "env": {
    "ROCKHOPPER_TOKEN": "rh_pat_your_token_here",
    "ROCKHOPPER_API_URL": "https://rockhopper.your-company.com"
  }
}
```

## Step 2 (Option B) — Remote install (Claude.ai, ChatGPT)

Web-based AI tools can't run `npx`, so they connect to our hosted gateway at `mcp.rockhopper.co` over HTTP with OAuth. You won't paste a PAT — you'll log in through your normal Rockhopper identity provider.

### Claude.ai

1. In Claude.ai click **Settings → Connectors → Add custom connector**.
2. Enter:
   * **Name**: `Rockhopper`
   * **URL**: `https://mcp.rockhopper.co/mcp`
3. Click **Connect**. A Rockhopper sign-in window opens — complete your normal SSO.
4. Approve the `read-only` (or `read-write`) scope. Claude.ai will show Rockhopper tools in the tool picker for every chat.

### ChatGPT

1. In ChatGPT open **Settings → Connectors → Add → Custom MCP**.
2. URL: `https://mcp.rockhopper.co/mcp`.
3. Complete the OAuth sign-in and approve the scope.

{% hint style="info" %}
The gateway mints a **short-lived** PAT (default 30 minutes) for each session and rotates it automatically. You can revoke active sessions at any time from the Access Tokens page — look for entries prefixed `gateway:`.
{% endhint %}

## OAuth 2.0 — building your own MCP client

If you're integrating an MCP client that isn't Claude.ai or ChatGPT, you can speak directly to the gateway's OAuth 2.0 surface. Rockhopper implements the [MCP authorization spec](https://modelcontextprotocol.io/specification/server/authorization/), which combines **Dynamic Client Registration** ([RFC 7591](https://www.rfc-editor.org/rfc/rfc7591)) with **Authorization Code + PKCE** ([RFC 7636](https://www.rfc-editor.org/rfc/rfc7636)).

### Endpoints

Discovery (RFC 8414):

```
GET https://mcp.rockhopper.co/.well-known/oauth-authorization-server
GET https://mcp.rockhopper.co/.well-known/mcp-protected-resource
```

Both unauthenticated; returns the canonical endpoint URLs for the rest of the flow.

### 1. Register a client (DCR)

```bash
curl -X POST https://mcp.rockhopper.co/register \
  -H "Content-Type: application/json" \
  -d '{
    "redirect_uris": ["https://your-app.example.com/oauth/callback"]
  }'
```

Response (HTTP 201):

```json
{
  "client_id": "<opaque>",
  "redirect_uris": ["https://your-app.example.com/oauth/callback"],
  "token_endpoint_auth_method": "none",
  "grant_types": ["authorization_code"],
  "response_types": ["code"]
}
```

The gateway issues **public clients only** (no `client_secret`) — PKCE is the integrity guarantee. Store the `client_id`; you'll need it for every authorize + token call.

### 2. Authorization request

Generate a PKCE `code_verifier` (43-128 chars, unreserved) and its `code_challenge` (`base64url(sha256(code_verifier))`). Direct the user's browser to:

```
GET https://mcp.rockhopper.co/authorize
    ?client_id=<client_id>
    &redirect_uri=https://your-app.example.com/oauth/callback
    &state=<random>
    &code_challenge=<S256-challenge>
    &code_challenge_method=S256
```

The gateway redirects the user to Rockhopper's web login at `app.rockhopper.co/login`. After SSO completes, the gateway redirects back to your `redirect_uri` with `?code=<short-lived>&state=<your-state>`.

### 3. Exchange code for access token

```bash
curl -X POST https://mcp.rockhopper.co/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=<code-from-callback>" \
  -d "client_id=<client_id>" \
  -d "code_verifier=<your-code-verifier>"
```

Response:

```json
{
  "access_token": "<opaque>",
  "token_type": "Bearer",
  "expires_in": 1800
}
```

`expires_in` reflects the underlying short-lived PAT's TTL (default 1800 seconds = 30 minutes).

### 4. Call MCP tools

```
POST https://mcp.rockhopper.co/mcp
Authorization: Bearer <access_token>
Content-Type: application/json
Accept: application/json, text/event-stream

{ "jsonrpc": "2.0", "method": "tools/list", "id": "1" }
```

### Token lifecycle

* **Tokens expire after \~30 minutes** (configurable server-side via `SESSION_PAT_TTL_MINUTES`).
* **No refresh tokens yet** — when a token expires, repeat the authorize → token flow. Refresh-token support is on the roadmap; until then, prompt the user to re-login.
* **No revocation endpoint yet** — the user can revoke active sessions from the Access Tokens page at `app.rockhopper.co` (look for `gateway:` entries) and the corresponding access tokens stop working immediately.

### Debugging the OAuth flow from Postman

The public Rockhopper MCP Postman workspace (see [MCP — Postman Workspace](/it-setup/mcp-postman-workspace)) doesn't include an OAuth-grant variant by default — the Bearer/PAT variant is the customer-facing path. For OAuth debugging:

1. Add a new MCP Request to your forked collection with `Authorization: OAuth 2.0` instead of Bearer Token
2. In the OAuth config: Grant Type **Authorization Code (with PKCE)**, Callback URL **Postman's default** (`https://oauth.pstmn.io/v1/callback`), Auth URL `https://mcp.rockhopper.co/authorize`, Token URL `https://mcp.rockhopper.co/token`
3. Get your `client_id` from a one-time `POST /register` (curl above) and paste it. Leave `Client Secret` blank.
4. Click **Get New Access Token** in Postman — opens the auth flow in your default browser.

If you're debugging issues with the OAuth flow itself (not your client), the gateway logs at `/ecs/{env}-mcp-gateway` in CloudWatch carry every `oauth.*` event.

## Step 3 — Verify the connection

Ask your AI assistant:

> "Using Rockhopper, list my enrolled files and tell me which one changed most recently."

If the connection works, you'll see it call `list_files`, then `get_file_versions` or `get_unattributed_changes`, and summarize the result. If it fails, see **Troubleshooting** below.

## What the AI can do

The server exposes three surfaces. Everything respects your existing workspace permissions — the AI cannot see files or workspaces you can't see.

### Tools (actions)

| Tool                       | Scope          | What it does                                                           |
| -------------------------- | -------------- | ---------------------------------------------------------------------- |
| `list_files`               | read-only      | List enrolled files in your workspace (optional search filter)         |
| `search_files`             | read-only      | Search enrolled files by name                                          |
| `get_file_versions`        | read-only      | List committed versions of a file (semver, author, timestamp)          |
| `get_file_comments`        | read-only      | List comment threads on a file (with replies, resolution state)        |
| `get_reviews`              | read-only      | List review requests for a specific version, or for the latest version |
| `get_cell_history`         | read-only      | Get how a single cell changed across versions                          |
| `get_unattributed_changes` | read-only      | List pending live-sheet edits not yet committed                        |
| `add_comment`              | **read-write** | Post a comment scoped to a file version                                |
| `reply_to_comment`         | **read-write** | Reply to an existing comment thread                                    |
| `resolve_comment`          | **read-write** | Mark a comment thread resolved (author-only)                           |
| `create_review_request`    | **read-write** | Open a review request and assign reviewers                             |
| `approve_review`           | **read-write** | Approve a review request (assignee-only)                               |
| `cancel_review`            | **read-write** | Cancel a pending review request (requester-only)                       |
| `create_version`           | **read-write** | Snapshot the live state as a new committed version                     |
| `discard_changes`          | **read-write** | Throw away pending live-sheet edits (return to last committed version) |
| `rename_file`              | **read-write** | Rename an enrolled file's display name                                 |

### Resources (read-only URIs your AI can fetch)

Standard MCP resources include file catalogs, version history, comment threads, and review dashboards. Your client will show them in its resource picker.

### Prompts (pre-authored workflows)

| Prompt                   | What it does                                                                                                     |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------- |
| `file-overview`          | Pulls versions, comments, reviews, and pending changes for one file, then asks the AI to write a status report   |
| `summarize-file-changes` | Surfaces the last five versions and twenty unattributed edits, then summarizes what changed and who made changes |
| `pending-reviews`        | Lists every reviewer status on the latest version and asks the AI to flag what needs attention                   |
| `unresolved-comments`    | Filters to open comment threads only and asks the AI to prioritize follow-ups                                    |

## Data governance

* PATs authenticate as **you** and inherit your permissions exactly. Revoking or downgrading your Rockhopper role propagates instantly.
* Read-only PATs cannot modify any data.
* Remote-gateway sessions use per-session short-lived PATs minted server-side; long-lived tokens never leave Rockhopper's infrastructure.
* All MCP traffic (local and remote) is logged with tool name, user id, and latency. Request/response bodies are **not** persisted.
* Comment contents are passed through unmodified. MCP's "untrusted content" guidance applies — your AI should treat comment text as user input, not instructions.

See [Security → Data Governance](/security-and-compliance/data-governance) for the full story.

## Troubleshooting

**"Invalid token" or 401 on every call.** The token may be expired or revoked. Create a new one from the Access Tokens page and update your client config.

**AI says "I don't have access to Rockhopper tools."** Fully quit and relaunch the client (Claude Desktop especially caches MCP state). In Cursor, toggle the server off/on in Settings.

**Rate-limited ("Too many requests").** PATs are throttled to 120 requests / minute by default. Ask the AI to batch queries or wait a minute.

**Self-hosted domain not working.** Confirm `ROCKHOPPER_API_URL` points to the same hostname you use in the browser, **without** a trailing slash.

**Remote gateway sign-in loops.** Clear cookies for `mcp.rockhopper.co` and try again. If your IdP blocks third-party cookies, open the gateway URL in a fresh browser window first to complete SSO, then retry from Claude.ai / ChatGPT.

**Need to revoke everything at once.** On the Access Tokens page click **Revoke** on every row; both long-lived and gateway-issued tokens disappear immediately.

## Getting help

Email <support@rockhopper.co> with:

1. The client you're using (Cursor / Claude Desktop / Claude.ai / etc.).
2. The token name (never the token value) and scope.
3. The AI's error message or transcript of the failing turn.


# MCP Server - Getting Started

> Connect your AI assistant to your Rockhopper workspace so it can audit cell-level history, run review workflows, and version your spreadsheet work — without leaving your chat.

This guide gets you connected in about 2 minutes. It works with any AI assistant that supports the Model Context Protocol — including Claude (Desktop, claude.ai), ChatGPT, Cursor, Endex, and others.

There are two ways to connect:

* **Option A — Sign in with Rockhopper (recommended).** No setup; you sign in through your browser like any web app.
* **Option B — Use an access token.** A short copy-paste alternative if your AI client doesn't support sign-in yet.

{% hint style="info" %}
**Want to try it before connecting your AI client?** The [Rockhopper MCP Postman Workspace](/it-setup/mcp-postman-workspace) lets you click through every Rockhopper tool against your own account in your browser — no install required. Great for previewing what your AI will be able to do.
{% endhint %}

***

## Option A — Sign in with Rockhopper (recommended)

The simplest path: your AI client connects to Rockhopper's hosted MCP gateway and opens a browser for you to sign in — just like signing in to any web app. No software to install, no token to copy or store.

### Step 1 — Add the Rockhopper MCP server to your AI client

In your AI client's settings, look for "Add MCP server", "Connectors", "Custom Integrations", or "Remote MCP Server". Provide:

* **URL:** `https://mcp.rockhopper.co/mcp`
* **Transport:** Streamable HTTP
* **Authentication:** OAuth 2.0 (your client handles this automatically — no client ID or secret to enter)

Different clients label things differently, but every supported client just needs the URL above.

### Step 2 — Sign in

When you save the new MCP server, your client opens a browser window pointing to Rockhopper. Sign in with your normal account (the same one you use at [app.rockhopper.co](https://app.rockhopper.co)) and approve the connection.

That's it — your AI assistant is now connected.

### Step 3 — Test it

Ask: *"List my Rockhopper files."* You should see your enrolled workbooks come back.

ℹ **One caveat:** Option A doesn't work with a small number of desktop AI clients that use a local-loopback (`http://localhost:…`) OAuth callback during sign-in. If your client's first sign-in attempt fails with a 403 at the registration step, use **Option B** below instead.

***

## Option B — Use an Access Token

Use this if your AI client doesn't yet support the sign-in flow above, or if your IT environment needs the connection to run locally instead of through the hosted gateway. You'll create an access token in Rockhopper, then paste it into your AI client's settings.

### Step 1 — Create an access token

1. Sign in at [app.rockhopper.co](https://app.rockhopper.co).
2. Click your avatar (top right) → **Access Tokens**.
3. Click **Create token** and fill in:
   * **Name** — something memorable (e.g. *My AI Assistant*)
   * **Permission level** — *Read & write* to let your AI post comments and open reviews; *Read-only* if you only want it to read
   * **Expires** — 90 days is a good default
4. Click **Create**. Copy the token (it starts with `rh_pat_…`) — Rockhopper only shows it once. Keep it somewhere safe, like your password manager.

### Step 2 — Add Rockhopper to your AI client

Open your AI client's MCP settings (often labeled "MCP Servers", "Custom Integrations", or "Tools"). Add a new server with these values:

| Field                | Value                                                 |
| -------------------- | ----------------------------------------------------- |
| Name                 | *Rockhopper*                                          |
| Type                 | *Local* / *stdio* (whichever your client offers)      |
| Command              | `npx`                                                 |
| Arguments            | `-y @rockhopper-co/mcp-server`                        |
| Environment variable | `ROCKHOPPER_TOKEN` = *(paste your token from Step 1)* |

Save the settings. Your AI client may ask to install Node.js if it's not already present — that's normal and safe.

### Step 3 — Restart your AI client and test

Most clients only pick up new MCP servers at startup. Quit and relaunch, then ask: *"List my Rockhopper files."*

{% hint style="info" %}
**For developers configuring this via a JSON config file** (Claude Desktop's `claude_desktop_config.json`, Cursor's `mcp.json`, VS Code's `.vscode/mcp.json`, etc.):

```json
{
  "mcpServers": {
    "rockhopper": {
      "command": "npx",
      "args": ["-y", "@rockhopper-co/mcp-server"],
      "env": {
        "ROCKHOPPER_TOKEN": "rh_pat_paste_your_token_here"
      }
    }
  }
}
```

Requires Node.js 20 or newer on the machine running the AI client, and outbound access to `registry.npmjs.org`. See the [main MCP Server page](/it-setup/mcp-server) for more configuration details.
{% endhint %}

***

## What your AI assistant can do once connected

Example things to ask:

* **Audit cell-level history:** *"Who last changed C12 in the Q3 P\&L Model, and what was it before?"*
* **Review uncommitted changes:** *"Show me every unattributed change in our budget model this week and who made them."*
* **Comment and collaborate inline:** *"Add a comment on Sheet1!B5 asking why this assumption shifted 10%."*
* **Run formal approval workflows:** *"Create a review request for the latest version of the Q3 forecast."*
* **Approve, cancel, or chase reviews:** *"List my pending review requests, then approve the one for the budget model."*
* **Version, snapshot, or roll back:** *"Create a new version called 'pre-board-edit', then discard uncommitted changes on the Q3 forecast."*

The AI will only see what your Rockhopper account is allowed to see. If you give it a `read-only` token, it cannot post comments or open reviews even if asked.

***

## Security notes

* Treat your Personal Access Token like a password. Don't paste it into chat messages, commit it to Git, or email it.
* You can revoke a token at any time from the same **Access Tokens** page — the effect is instant.
* Rockhopper logs every action taken through MCP just like every other action in the app, so you'll see your AI's activity in your audit log.

***

## Help & support

* **Documentation:** [docs.rockhopper.co/it-setup/mcp-server](https://docs.rockhopper.co/it-setup/mcp-server)
* **Support:** <support@rockhopper.co>
* **Sandbox / try-before-installing:** there's a [Postman workspace](https://docs.rockhopper.co/it-setup/mcp-postman-workspace) you can click through to see every tool exercised against your account before you wire it into your AI client.

If you hit any issue — wrong tool behavior, OAuth errors, or anything that doesn't match this guide — email support and we'll get you unstuck. Please mention which AI client you're using; it helps us reproduce.


# MCP — Postman Workspace

[<img src="https://run.pstmn.io/button.png" alt="Run In Postman" data-size="line">](https://god.gw.postman.com/run-collection/54299481-0b80e147-9f26-4fe5-8a87-a5dcc4a993bc?action=collection%2Ffork\&source=rip_markdown\&collection-url=entityId%3D54299481-0b80e147-9f26-4fe5-8a87-a5dcc4a993bc%26entityType%3Dcollection%26workspaceId%3Dfd36303d-a194-4e6e-978a-3b159249ec65)

Postman is the easiest way to **test and document** Rockhopper's MCP server outside of an AI client. Use it when you want to:

* Verify a Personal Access Token works before pasting it into Cursor or Claude.
* Explore every tool, resource, and prompt with a UI rather than a chat transcript.
* Hand a customer or teammate a one-click way to try the integration.
* Compare local (stdio) and remote (HTTP) transports side by side.

This page covers installing Postman, importing the Rockhopper workspace, configuring environments, and running your first request. For setting up the MCP server in your AI client (Cursor, Claude Desktop, Claude.ai, etc.) see [MCP Server (AI Integration)](/it-setup/mcp-server).

{% hint style="info" %}
Postman added a first-class **MCP Request** type in mid-2025, alongside REST, GraphQL, gRPC, and WebSocket. You'll need Postman Desktop **v11.x or newer** — older versions don't support MCP at all.
{% endhint %}

## When to use Postman vs other clients

| If you want to...                                                                  | Use                                                                                                  |
| ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| Have an AI assistant in Cursor/Claude/VS Code call Rockhopper for you              | The [local `npx` install](/it-setup/mcp-server#step-2-option-a-local-install-with-npx)               |
| Have Claude.ai or ChatGPT on the web call Rockhopper                               | The [remote gateway](/it-setup/mcp-server#step-2-option-b-remote-install-claude-ai-chatgpt)          |
| Click around tools/resources/prompts manually, see raw JSON, share with a teammate | **This guide** (Postman)                                                                             |
| Inspect the protocol while developing the server itself                            | The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) (engineer-only, internal use) |

## Collection layout

The `Rockhopper MCP Server` collection follows the [Postman peer-vendor pattern](https://www.postman.com/explore/mcp-servers) used by PayPal, GitHub, HubSpot, and Postman's own MCP catalog:

```
Rockhopper MCP Server
├── Remote/
│   └── Rockhopper MCP — HTTP + PAT     ← hosted gateway, Bearer auth (PAT)
└── Local/
    └── Rockhopper MCP — Local (stdio)  ← spawns @rockhopper-co/mcp-server via npx
```

Both variants expose the **same 16 tools / 4 prompts / 10 resources** — they're two different ways to reach the same server. Pick whichever matches your environment:

| Variant                 | When to use                                                                    | Transport                    | What spawns                                                            |
| ----------------------- | ------------------------------------------------------------------------------ | ---------------------------- | ---------------------------------------------------------------------- |
| **Remote — HTTP + PAT** | Default. Fast, no install.                                                     | HTTPS to `mcp.rockhopper.co` | Nothing local — talks to our hosted gateway                            |
| **Local — stdio**       | Behind corporate firewall; want to inspect the npm package; offline-by-default | stdio to a child process     | `npx -y @rockhopper-co/mcp-server` on your machine (Node 20+ required) |

## Prerequisites

* An active Rockhopper account with at least one enrolled file (so the read tools have something to return).
* A Personal Access Token. Create one from **Avatar → Access Tokens** in app.rockhopper.co — see [the PAT walkthrough](/it-setup/mcp-server#step-1-create-a-personal-access-token-pat).
* Postman Desktop v11.x or newer ([download](https://www.postman.com/downloads/)). Postman Web does support MCP requests, but the **Local (stdio)** variant requires the desktop app — only desktop can spawn child processes.
* Node.js 20+ on your machine — only needed for the Local (stdio) variant. Remote (HTTP) doesn't touch your machine.

## Step 1 — Install and sign in

1. Install Postman Desktop and sign in with your Postman account (free tier is sufficient).
2. Confirm version: **Help → About**. The "Version" line should start with `11.` or higher.

## Step 2 — Fork the Rockhopper workspace

Easiest path: click the **Run In Postman** button at the top of this page. Postman Desktop opens with the collection ready to fork into a workspace of your choice. Or do it manually:

1. Open the [Rockhopper MCP — Public workspace](https://www.postman.com/rockhopper-co/rockhopper-mcp-public).
2. Click **Fork → Fork Collection** on the **Rockhopper MCP Server** collection. Choose your personal or team workspace as the destination.
3. Also fork the **Production (template)** environment — it has `GATEWAY_URL` pre-filled and a blank `ROCKHOPPER_PAT` slot for your token.

{% hint style="warning" %}
**Don't use export-then-import for MCP collections.** Postman's REST API and Collection v2.1 export format cannot represent MCP Request items (they're a Postman-cloud-native type, not part of the v2.1 schema). A JSON export of the collection would lose both MCP Request items entirely. Fork is the only way to preserve them.
{% endhint %}

## Step 3 — Configure your environment

The collection uses two variables across both variants:

| Variable         | Purpose                   | Value                                                |
| ---------------- | ------------------------- | ---------------------------------------------------- |
| `GATEWAY_URL`    | Where Remote requests go  | `https://mcp.rockhopper.co` (pre-filled in template) |
| `ROCKHOPPER_PAT` | Your authentication token | Your `rh_pat_…` token — you fill this in             |

After forking the environment:

1. Click the **eye icon** next to the env dropdown (top-right) → **Edit** on your forked env.
2. Find the `ROCKHOPPER_PAT` row.
3. Paste your `rh_pat_…` token into the **Current Value** column (not Initial Value).
4. Click **Save**.

{% hint style="warning" %}
Never put a PAT in the **Initial Value** column. Initial Value syncs when you export or fork the environment — your PAT would leak to anyone who forks. The **Current Value** column stays local to your machine and never syncs.
{% endhint %}

5. Confirm the environment is active in the top-right dropdown.

## Step 4 — Try the Remote variant first (fastest)

Open `Remote/Rockhopper MCP — HTTP + PAT`.

1. Click **Load Capabilities**. Postman calls `initialize` + `tools/list` + `resources/list` + `prompts/list` against the hosted gateway at `{{GATEWAY_URL}}/mcp`.
2. Wait \~1 second. The **Tools**, **Resources**, and **Prompts** tabs populate.
3. Open the **Tools** tab. You should see 16 tools (`list_files`, `get_file_versions`, `create_version`, `add_comment`, etc.).
4. Click `list_files` (it takes no arguments) → click **Run**.
5. The response pane shows your enrolled files as JSON.

If `list_files` returns your files, the Remote variant works end-to-end. You can pick any tool, fill in arguments via Postman's form UI, and click **Run**.

The **Resources** tab lets you read individual data sources (file metadata, version history, comments, etc.) by URI. The **Prompts** tab lets you run pre-built workflow templates.

{% hint style="info" %}
Want to verify the gateway is reachable without auth? `curl https://mcp.rockhopper.co/healthz` from a terminal returns `{"status":"ok"}` on a live deployment. This is the only unauthenticated endpoint.
{% endhint %}

## Step 5 — Try the Local (stdio) variant (optional)

This variant runs the MCP server as a child process on your machine. Useful for corporate-firewall environments where outbound HTTPS to `mcp.rockhopper.co` is blocked, or when you want to inspect what the npm package does.

Open `Local/Rockhopper MCP — Local (stdio)`.

1. Confirm the **Command** is `npx` with **Arguments** `-y @rockhopper-co/mcp-server`.
2. Open the **Environment** tab on the request. You should see a single row:
   * **Key**: `ROCKHOPPER_TOKEN`
   * **Value**: `{{ROCKHOPPER_PAT}}` (in template-variable blue — substituted from your env at run time)
3. Click **Connect** (top-right, blue button). On first run, npx downloads `@rockhopper-co/mcp-server` from npm (\~10 seconds); subsequent runs reuse the cache.
4. Status pill turns green: **Connected**. Now click **Load Capabilities** — same 16 tools / 4 prompts / 10 resources as Remote.

{% hint style="info" %}
**The env var inside the MCP Request differs from the Postman variable name.** Postman variable `ROCKHOPPER_PAT` gets substituted into the **process env var** `ROCKHOPPER_TOKEN`, which is what `@rockhopper-co/mcp-server` reads (per `mcp-server/src/cli.ts:9`). Don't rename either side without updating both.
{% endhint %}

### Self-hosted Rockhopper

If your company runs Rockhopper at a custom domain, add a second env-var row in the request's Environment tab:

| Key                  | Value                                 |
| -------------------- | ------------------------------------- |
| `ROCKHOPPER_TOKEN`   | `{{ROCKHOPPER_PAT}}`                  |
| `ROCKHOPPER_API_URL` | `https://rockhopper.your-company.com` |

The npm package's CLI reads both. `ROCKHOPPER_API_URL` defaults to `https://api.rockhopper.co` if unset.

## When to pick which variant

* **Always start with Remote (HTTP + PAT)** — it's fastest and exercises the same production gateway that AI clients hit.
* **Switch to Local (stdio) if**:
  * Your network blocks `mcp.rockhopper.co`.
  * You're debugging the npm package itself.
  * You want bit-for-bit reproducibility with what Cursor / Claude Desktop run locally.

Both variants share the same `ROCKHOPPER_PAT` env value, so you only need one PAT.

## Troubleshooting

**"Invalid token" / 401 on every Remote request.** The PAT might be expired, revoked, or pasted with whitespace. Re-create the token from app.rockhopper.co and paste it carefully into the `ROCKHOPPER_PAT` env var's **Current Value**.

**Local (stdio) shows "Couldn't run the request: MCP error -32000: Connection closed".** Three usual suspects:

1. The active env's `ROCKHOPPER_PAT` Current Value is blank. Check the env dropdown is set to your filled env, not `Production (template)`.
2. The env var name inside the request is wrong. Must be `ROCKHOPPER_TOKEN` (not `ROCKHOPPER_API_TOKEN`, not `ROCKHOPPER_PAT`) — that's the variable the npm package reads.
3. Node.js isn't on your PATH or is older than 20. Run `node --version` in a terminal.

**Healthz passes but tools return errors.** Make sure the `ROCKHOPPER_PAT` variable has your actual token, not a placeholder. The health endpoint doesn't require auth, but all tool calls do.

**Empty responses or "No Environment".** Make sure the environment dropdown (top-right) is set to your forked env, not **No Environment** and not a template. Postman silently swallows the request when env vars are unbound.

**"Disconnected" pill won't go away on Local (stdio).** Open **View → Show Postman Console** (Cmd+Alt+C), click **Connect** again, and read the stderr from the spawned child process. The mcp-server's startup errors land there.

**Stuck import or duplicate collections.** Delete the collection (right-click → **Delete**) and re-fork from the public workspace. Postman's fork is idempotent — you'll lose any local request edits but environments are preserved.

## What Postman cannot do for you

* **Postman cannot replace an AI client.** It's a manual exerciser — clicking Run is up to you. For autonomous AI workflows (e.g. "summarize this week's changes"), use Cursor / Claude Desktop / Claude.ai with the proper MCP install.
* **Postman cannot mint a long-lived gateway PAT for you.** Use the Access Tokens UI in app.rockhopper.co for that. OAuth sessions minted by web AI clients are short-lived (\~30 min) and rotated server-side.
* **Postman cannot bypass workspace permissions.** Whatever you can see in the Rockhopper app is exactly what the MCP surface returns — same RBAC, same audit trail.

## Getting help

Email <support@rockhopper.co> with:

1. Postman Desktop version (Help → About).
2. Which variant is failing (Remote or Local).
3. The environment you're using.
4. The full response, including status code and any error text Postman shows in the **Console** tab.


# Technical Requirements

## Platform requirements

### Microsoft 365

| Requirement      | Details                                                                                       |
| ---------------- | --------------------------------------------------------------------------------------------- |
| **License**      | Microsoft 365 Business Basic or higher (any plan with OneDrive for Business and Excel Online) |
| **Identity**     | Microsoft Entra ID (included with all M365 Business and Enterprise plans)                     |
| **File storage** | OneDrive for Business or SharePoint Online                                                    |

### Google Workspace

| Requirement      | Details                                     |
| ---------------- | ------------------------------------------- |
| **License**      | Google Workspace Business Starter or higher |
| **File storage** | Google Drive                                |

## Supported browsers

The Rockhopper web application works in all modern browsers:

| Browser         | Supported versions      |
| --------------- | ----------------------- |
| Google Chrome   | Latest 2 major versions |
| Microsoft Edge  | Latest 2 major versions |
| Mozilla Firefox | Latest 2 major versions |
| Safari          | Latest 2 major versions |

## Supported spreadsheet platforms

### Excel (via add-in)

| Platform          | Supported versions                       |
| ----------------- | ---------------------------------------- |
| Excel for Windows | Microsoft 365 (subscription), Excel 2021 |
| Excel for Mac     | Microsoft 365 (subscription), Excel 2021 |
| Excel Online      | All versions                             |

### Google Sheets (via sidebar add-on)

Google Sheets is supported in all modern browsers via the Rockhopper sidebar add-on.

## Network requirements

If your organization uses a firewall or proxy, ensure the following domains are accessible:

| Domain                      | Purpose                              |
| --------------------------- | ------------------------------------ |
| `app.rockhopper.co`         | Rockhopper web application           |
| `api.rockhopper.co`         | Rockhopper API server                |
| `login.microsoftonline.com` | Microsoft authentication             |
| `graph.microsoft.com`       | Microsoft Graph API                  |
| `accounts.google.com`       | Google authentication                |
| `*.googleapis.com`          | Google Drive and Sheets APIs         |
| `*.sharepoint.com`          | SharePoint / OneDrive file access    |
| `*.officeapps.live.com`     | Office Online / Excel add-in hosting |

## Data residency

All data processing and storage occurs within Amazon Web Services (AWS) data centers. For specific data residency requirements, contact <privacy@rockhopper.co>.