MCP access is an entitlement of every paid Binary³ RQE plan — there is no separate MCP subscription, no MCP checkout, and no per-call MCP billing. The price of MCP access is the RQE plan price, and every MCP allowance is a hard monthly cap: exhaustion is a rejection, never a charge.
What a customer pays. Resolved — through RQE. MCP has no plan names, amounts, or billing intervals of its own. The price of MCP access is the RQE plan price: Sandbox $0 (sandbox credentials only), Developer $49/mo, Professional $149/mo, Business $499/mo, Enterprise custom.
Which tools a credential may call. Implemented at the credential layer. Each MCP credential carries explicit tool scopes from a closed vocabulary of two: keysweep_scan_text and microdefend_scan_website. A credential without a tool's scope is refused.
How much usage is permitted. Implemented. Every accepted tool call consumes server-side quota keyed to the credential and its plan tier, across per-minute, per-hour, and per-day windows aligned to UTC.
How money is collected. Never standalone. No MCP checkout, subscription, or metered billing exists — MCP is billed only as part of an RQE subscription. Quota enforcement is not billing; consuming allowance charges nothing, and exhaustion never triggers a charge.
keysweep_scan_textValidates input before consuming quota. A request rejected as invalid_text or text_too_large consumes nothing. An accepted analysis consumes one unit of allowance.
microdefend_scan_websiteConsumes quota before validating the target. A scan rejected afterward — invalid_target, blocked_ip, and the other target rejections — still decrements the allowance. This ordering is implementation behavior, disclosed here because it affects fair use.
Exhausted quota returns rate_limit_exceeded. If a quota control cannot be evaluated, the call fails closed — quota_unavailable or rate_limit_unavailable — and the tool does not run. Windows are consumed in sequence (minute, then hour, then day), so a rejection at a later window or a store failure partway can leave an earlier window consumed. Overage is rejection, not a charge. A separate transport limiter answers floods with 429 rate_limited; it never touches allowance.
Each short window is a fixed UTC bucket — minute, hour, day — and a fresh bucket starts when the boundary passes. On top of the windows, every plan carries a monthly MCP tool-call allowance that resets with the RQE plan's monthly cycle. All of it is a hard cap: exhaustion is rejection, not a charge.
Window counters are updated atomically in the database, so simultaneous calls cannot overspend a window. If the quota store cannot be updated, the call is denied — metering never fails open into unmetered usage. A store failure partway through the window sequence can leave earlier windows consumed.
Qualified: the public JWKS verification surface, and authenticated MCP end to end (post-roadmap production qualification gate, 2026-09-14). Not a billing surface: MCP itself never bills — access rides the RQE subscription, and purchasing access does not change authentication qualification. The full security model lives at /mcp/security.
MCP access covers the Binary³ security tools listed at /mcp/tools — nothing else. It does not include, require, or bundle Axon, and MCP calls do not pass through Axon enforcement. When MCP plans are published they will be named around security tool usage — not protocol sessions, and not other products.
MCP has no free tier of its own. Credentials are issued from the RQE developer portal, where the free tier is sandbox-only; live MCP credentials require a paid RQE developer plan — an existing RQE subscription, not a separate MCP purchase.
The ordering is the same for both tools: KeySweep rejects invalid input before consumption, and MicroDefend validates and authorizes the target before any allowance is consumed — a rejected target uses no allowance. This ordering is described above and guarded by tests against the implementation.
The call is rejected with rate_limit_exceeded until a window rolls over. Nothing is charged, because there is no metered billing to charge with.
Yes — as an entitlement of the canonical RQE plans. Sign up at the RQE developer portal, choose a paid plan for live MCP credentials, and issue a credential from the portal. Sandbox accounts get sandbox-scoped MCP access free.
To discuss intended use, Enterprise terms, or volume questions, contact the Binary³ team. Include the agent environment (client or custom runtime) and the security tools you expect to call, so the conversation starts with practical context — expected tool-call volume is more useful than seat counts.