Skip to content

Security model in brief

Section 16 · From docs/MCP.md on GitHub

The details are in MCP_PRIVACY.md. The parts that touch this guide:

  • The policy decides visibility (is_allowed, used for lists and lookups) and access (check_call, at call time), applies rate limits, and builds per-principal input and output transform pipelines. Hidden primitives are indistinguishable from nonexistent ones.
  • standard (the default) redacts secrets, drops private keys, masks credential ids, sanitizes attacker-controllable text such as names, tags and descriptions, refuses secrets in arguments and denies reveal except to admin and privacy-admin. strict pseudonymizes identifiers as well and hides the collecting, export and restricted tools.
  • Pseudonyms round-trip: a pseudonymized ARN passed back as an argument is reversed by the input pipeline before validation. Set CLOUDG_MCP_VAULT_KEY if pseudonyms must stay stable across restarts.
  • Every transport binds to 127.0.0.1 by default, and every HTTP flavor runs the same Origin / Host guard (section 7) and supports static bearer tokens mapped to roles. The native server warns at start-up when bound to a non-loopback address without tokens. An empty token stops the server before it starts, a session id works only for the principal that opened it, and the native server caps connections, sessions per principal and the time a client may take to send a request (6.2).
  • Error messages never repeat the caller's arguments or list names from the dataset; that detail goes into cloudg/error_data, which passes through the output pipeline. Values the input pipeline restored from pseudonyms are pseudonymised again in everything that leaves the call: results, errors, links, progress and log messages. Unexpected exceptions in resource and prompt handlers reach the client as a generic error.
  • --registry imports and runs operator code; never build its value from untrusted input.
  • File access is confined to the allowed roots and writes to the output directory.
  • Audit trails: the JSONL middleware (hashed argument values, completions included) and the policy's decision log, which also records calls to unknown or hidden primitives (not_found) and arguments refused by the input pipeline; every reveal is logged to cloudg.mcp.audit at WARNING.
  • Live cloud calls go through the credential preflight and the live operation guard (section 15), so a model cannot hammer the provider APIs by repeating a collection.
  • Tool annotations are derived from declared capabilities so clients can tell read-only tools from those with side effects (see MCP_INTERNALS.md).