Traffic Protection & Rate Limits

Playground protects itself against automated scanners and abusive traffic so that the service stays available for everyone. This page explains what that means for people and for the tools that connect to Playground, such as the VS Code extension and the MCP server.

What it means for you

For normal use you will not notice any of this. People signed in through the browser, the VS Code extension and the MCP server work as before.

What Playground does

  • Blocks automated probing. Requests for pages that never exist on Playground, the kind sent by automated vulnerability scanners, are rejected immediately and do not reach your data.
  • Rejects unknown addresses. A request to an address that does not belong to a Playground domain receives a 404 response.
  • Limits request volume. Each client has a request budget per minute. Normal browsing and tool use stay far below it. A client that exceeds it receives a 429 Too Many Requests response with a Retry-After header saying how many seconds to wait.
  • Temporarily blocks repeat abusers. Anonymous clients that repeatedly send probing requests are blocked for a while.

Authenticated tools

The VS Code extension and the MCP server sign in with an app password. Requests made with an app password are limited per user credential, not per network address, so:

  • one busy user does not slow down others, even when many users reach Playground through the same MCP server;
  • an authenticated tool is never blocked because of unrelated network traffic.

If you see a 429 response

  1. Wait the number of seconds given in the Retry-After header and try again.
  2. If you are building an integration, retry with exponential backoff and avoid tight polling loops. Batch requests where you can.
  3. If you reach the limit during legitimate, regular use, contact us with the approximate time and what you were doing so we can review the limit.

If you see a 404 for your own domain

Check the address: Playground domains look like your-company.playg.app. A mistyped sub-domain returns 404 because no such domain exists. In the VS Code extension, make sure the Domain URL starts with https:// and ends with playg.app.

What this does not change

Traffic protection reduces noise and protects availability. Sign-in, roles and permissions work exactly as described in Authentication Mechanism and Roles. To count requests, Playground keeps network addresses and a one-way hash of the credential in memory for a short time. They are not written to the database. What is stored persistently is described in What we store.