MCP Security

Transport URL protection

• Upstream transport URLs are stored in the database, never returned in API request bodies
• API responses mask transport URLs (transport_url_masked)
• Request bodies reject transport_url, url, upstream, endpoint fields
• Credential fields (secret, token, auth, etc.) are rejected at registration

SSRF / private network protection

Transport URLs must resolve to public addresses. Private IPs, localhost, and link-local addresses are blocked. URLs with embedded credentials are rejected.

Policy and allowlist enforcement

• Every MCP discover, call, and session request runs policy evaluation first
• Agent allowed_tools filter discovery results
• Agent allowed_resources and allowed_tools checked at execution
• Approval-required tools create approval requests before execution
• All MCP operations are recorded in the audit log

Cross-workspace isolation

MCP servers are scoped to the workspace that registered them. An API key can only access servers in its own workspace. Server slugs are unique per workspace.