On this page
MCP Security
Required posture
- Use HTTPS in production.
- Validate the endpoint hostname and workspace reference.
- Keep host and connector credentials outside prompts, model context, generated code, logs, and browser storage.
- Never pass a token issued for one resource to another resource.
- Treat tool descriptions, remote content, and tool results as untrusted input.
- Require human or policy approval before sensitive data sharing or action.
- Apply deterministic allowlisting, timeouts, cancellation, response limits, and redaction.
Origin and network controls
The public MCP route rejects unapproved browser origins. Outbound MCP connections require separate hostname, port, address, redirect, and DNS-rebinding controls; this inbound endpoint does not become an arbitrary proxy.
Evidence
Tool calls record workspace-scoped session and activity hashes when the schema is installed. Proposal and approval-gated tools also preserve their review and policy evidence without placing raw credentials in the record.
Incident response
Suspend or revoke the host, close active sessions, rotate the credential, preserve request IDs and timestamps, and contact support. Do not share the credential itself.