Security Overview - Secure MCP Gateway

Introduction

The Secure MCP Gateway implements a comprehensive security architecture designed to protect Model Context Protocol (MCP) communications from a wide range of threats. This page provides an overview of the security model, architecture, and protection mechanisms.

Security-First Design: The gateway acts as a security layer between MCP clients (like Claude Desktop, Cursor) and MCP servers, enforcing authentication, authorization, and guardrails on all communications.

Threat Model

The Secure MCP Gateway protects against the following threat categories:

Critical Threats (Rank 1-4)

Prompt Injection

Risk Level: Critical (Rank #1)Attackers attempt to manipulate AI behavior by injecting malicious instructions through:

Tool descriptions containing hidden commands
Server metadata with instruction overrides
User data embedding system prompts
Document content with context hijacking

Mitigation: Injection attack detection, policy violation guardrails

Command Injection

Risk Level: Critical (Rank #2)Exploitation of OS command execution through:

Unsanitized parameters passed to shell commands
File paths with embedded shell metacharacters
Tool arguments containing command separators

Mitigation: Command injection detection, tool registration validation

Remote Code Execution (RCE)

Risk Level: Critical (Rank #4)Direct code execution in application runtime via:

Unsafe deserialization (pickle, YAML, JSON)
Template injection (Jinja2, Twig)
Dynamic code evaluation (eval, exec)

Mitigation: Server/tool registration guardrails, keyword detection

High-Risk Threats (Rank 5-10)

Credential Theft

Unauthorized access to:

Environment variables with secrets
Configuration files with API keys
Authentication tokens and sessions

Mitigation: PII detection, sensitive data masking

Path Traversal

Directory traversal attacks:

Reading arbitrary files (../../etc/passwd)
Writing to restricted locations
Zip slip vulnerabilities

Mitigation: Tool validation, keyword blocking

Server-Side Request Forgery

Unauthorized network access:

Internal network scanning
Cloud metadata service access
Bypassing network restrictions

Mitigation: OpenWorldHint validation, policy checks

Resource Exhaustion

Denial of service through:

Infinite loops and CPU exhaustion
Memory bombs and allocation attacks
Disk space consumption

Mitigation: Timeout management, sponge attack detection

Security Architecture

Multi-Layer Defense

The gateway implements defense-in-depth with multiple security layers:

Security Components

Authentication Layer

API Key Validation: Every request requires a valid gateway API key

Key-based authentication with project/user context
Secure key generation (256-character random strings)
Key rotation and management capabilities

Implementation: Plugin-based auth system supports local and remote validation

Server Registration Validation

Tool Discovery Protection: Validates MCP servers during discovery

Server metadata scanning for malicious patterns
Tool description analysis for injection attempts
Destructive/OpenWorld hint enforcement

Block Mode: Prevents registration of unsafe servers entirely

Input Guardrails

Pre-Execution Protection: Validates requests before sending to servers

Content analysis for threats and policy violations
PII detection and automatic redaction
Injection attack prevention

Configurable: Per-server guardrail policies with custom block lists

Output Guardrails

Post-Execution Protection: Validates responses before returning to client

All input checks plus output-specific validations
Relevancy and adherence checking
Hallucination detection
Automatic PII de-anonymization

Smart Restoration: PII redacted on input is restored in safe outputs

Protection Mechanisms

1. Guardrail System

The guardrail system provides real-time threat detection and prevention:

{
  "server_name": "github_server",
  "enable_tool_guardrails": true,
  "input_guardrails_policy": {
    "enabled": true,
    "policy_name": "Sample Airline Guardrail",
    "additional_config": {
      "pii_redaction": true
    },
    "block": [
      "policy_violation",
      "injection_attack",
      "toxicity",
      "nsfw",
      "keyword_detector",
      "bias"
    ]
  },
  "output_guardrails_policy": {
    "enabled": true,
    "policy_name": "Sample Airline Guardrail",
    "additional_config": {
      "relevancy": true,
      "adherence": true,
      "hallucination": false
    },
    "block": [
      "policy_violation"
    ]
  }
}

2. Authentication & Authorization

API Key Management:

Unique keys per user-project combination
Automatic generation with high entropy
Secure storage and retrieval
Rotation capabilities

Admin API Security:

Separate admin API key (256-char random)
Bearer token authentication for REST API
CORS configuration for web access

3. Sensitive Data Protection

Environment Variables
HTTP Headers
Cache Keys

Auto-Masking: Sensitive environment variables are automatically masked in logs

# Masked patterns
sensitive_keys = [
    "token", "key", "secret", "password",
    "auth", "credential", "apikey", "api_key"
]

# Example
"AWS_SECRET_ACCESS_KEY" → "AWS_****_KEY"

Header Sanitization: Authentication headers masked in telemetry

# Masked headers
sensitive_patterns = [
    "authorization", "bearer", "cookie",
    "session", "x-api-key", "x-auth"
]

# Example
"Authorization: Bearer abc123" → "Au***23"

Key Hashing: All cache keys are MD5 hashed

import hashlib

def hash_key(key):
    return hashlib.md5(key.encode()).hexdigest()

# Prevents exposure of sensitive identifiers

4. Timeout Management

Operation Timeouts: Prevents resource exhaustion attacks

Operation Type	Default Timeout	Purpose
Guardrail Validation	15s	Prevent DoS via guardrail API
Tool Execution	60s	Limit long-running tools
Discovery	20s	Bound server discovery time
Authentication	10s	Fast-fail auth checks
Cache Operations	5s	Quick cache access

Escalation Policies:

Warn at 80% of timeout
Hard timeout at 100%
Failure at 120% (grace period)

Fail-Safe Defaults

Security Posture: The gateway implements fail-closed defaults for security-critical operations

Fail-Closed Scenarios

Guardrail API Errors: If guardrail validation fails due to API errors or timeouts, block the request
Tool Registration Errors: If tool validation encounters errors, prevent tool registration
Authentication Failures: If auth validation fails, reject the request
Unauthorized Access: If API key validation fails with auth errors, block access

Fail-Open Scenarios

Discovery Errors (non-guardrail): Allow server discovery if not using tool guardrails
Cache Failures: Fall back to direct queries if cache is unavailable
Telemetry Errors: Continue operation if logging/tracing fails

Security Best Practices

For Gateway Administrators

Use Strong API Keys: Generate keys with high entropy (use built-in generator)
Enable Guardrails: Always enable guardrails for external/untrusted MCP servers
Configure Block Lists: Customize block lists based on your threat model
Monitor Metrics: Track guardrail blocks and violations in Grafana
Rotate Keys Regularly: Use secure-mcp-gateway apikey rotate periodically
Review Logs: Check structured logs for security events
Use External Cache: Deploy Redis/KeyDB for multi-instance setups
Backup Configs: Regular backups with secure-mcp-gateway system backup

For MCP Server Developers

Clear Tool Descriptions: Write accurate descriptions without promotional language
Set Proper Annotations:
- destructiveHint: true for any tool that modifies state
- readOnlyHint: true only for truly read-only operations
- openWorldHint: true if tool accesses external networks
Validate Inputs: Always validate and sanitize tool parameters
Avoid Dangerous Patterns: Don’t use eval, exec, pickle, or shell commands
Least Privilege: Request minimum necessary permissions
Document Security: Clearly document any security considerations

For End Users

Trust But Verify: Review MCP servers before adding to gateway
Check Tool Descriptions: Look for suspicious or vague descriptions
Review Permissions: Understand what destructive/openWorld tools do
Report Issues: Report suspicious servers to gateway administrators
Use Separate Projects: Isolate high-risk servers in dedicated projects

Security Metrics & Monitoring

Key Metrics

Guardrail Performance:

guardrail_blocks_total - Total requests blocked by guardrails
guardrail_violations_by_type - Violations by type (injection, PII, etc.)
guardrail_latency_ms - Guardrail evaluation time
pii_redactions_total - PII redaction operations

Authentication Metrics:

auth_failures_total - Failed authentication attempts
auth_latency_ms - Authentication check duration
active_api_keys - Number of active keys

Tool Security Metrics:

tool_registrations_blocked - Tools blocked during discovery
server_registrations_blocked - Servers blocked during validation
destructive_tools_executed - Destructive tool invocations

Grafana Dashboards

The gateway includes pre-built Grafana dashboards for security monitoring:

Security Overview: High-level security posture
Guardrail Performance: Detailed guardrail metrics
Threat Detection: Real-time threat indicators
Audit Trail: Complete request/response audit log

Next Steps

Guardrail Types

Explore all guardrail types and detection mechanisms

PII Handling

Learn about PII detection, redaction, and de-anonymization

Security Testing

Test your security posture with bad_mcps attack scenarios

Configuration

Configure guardrails for your MCP servers

Resources

MCP Security Top 25

Adversa.ai vulnerability ranking

JFrog RCE Research

MCP command injection vulnerability

Enkrypt Blog

How the Gateway prevents top attacks

Get Started

Core Concepts

Features

Deployment

Client Integration

Observability

Security

Guides

​Introduction

​Threat Model

​Critical Threats (Rank 1-4)

​High-Risk Threats (Rank 5-10)

Credential Theft

Path Traversal

Server-Side Request Forgery

Resource Exhaustion

​Security Architecture

​Multi-Layer Defense

​Security Components

​Protection Mechanisms

​1. Guardrail System

​2. Authentication & Authorization

​3. Sensitive Data Protection

​4. Timeout Management

​Fail-Safe Defaults

​Fail-Closed Scenarios

​Fail-Open Scenarios

​Security Best Practices

​Security Metrics & Monitoring

​Key Metrics

​Grafana Dashboards

​Next Steps

Guardrail Types

PII Handling

Security Testing

Configuration

​Resources

MCP Security Top 25

JFrog RCE Research

Enkrypt Blog

Build docs developers (and LLMs) love

Introduction

Threat Model

Critical Threats (Rank 1-4)

High-Risk Threats (Rank 5-10)

Security Architecture

Multi-Layer Defense

Security Components

Protection Mechanisms

1. Guardrail System

2. Authentication & Authorization

3. Sensitive Data Protection

4. Timeout Management

Fail-Safe Defaults

Fail-Closed Scenarios

Fail-Open Scenarios

Security Best Practices

Security Metrics & Monitoring

Key Metrics

Grafana Dashboards

Next Steps

Resources