Security model

What the platform assumes about your server, and what it will not do for you.

The platform treats a tool server as a trusted party with an untrusted surface: you were deliberately connected, and everything you send is still checked.

What the platform enforces

Host allowlist

Only hosts on MCP_ALLOWED_HOSTS are contacted, and an empty list denies everything rather than allowing everything. A customer cannot point an assistant at an arbitrary URL — that would be SSRF plus a channel handing a stranger the conversation.

Description sanitisation

Descriptions land in the system prompt, so instruction-shaped text is stripped and the whole thing is capped and flattened to one line.

Name namespacing

Remote tools are exposed as srv<id>__<name>, so no server can shadow the assistant’s own tools.

Tenant pinning

Every call runs inside an explicit tenant context. One workspace’s assistant can only reach servers connected to that workspace.

Idempotent writes

See Side effects.

What you must enforce

Authenticate every request. The token is per workspace. Treat it as the only statement of who is calling — never trust a workspace or buyer identifier that arrives in tool arguments, because those come from a language model.

• Authorise per buyer. buyer_ref says who; what they may see or do is your decision, resolved from your own records.
• Resolve entitlements server-side. Price tier, discount eligibility, wholesale access. If it can be passed as an argument, it can be argued into.
• Validate arguments. The schema subset is lossy, and constructs the platform drops are not enforced anywhere.
• Never return another buyer’s data. A tool that takes an id and returns the record is a lookup oracle unless it is scoped.

Prompt injection through content

A customer can put text in a product name. If your tool returns it, the model reads it. Treat anything customer-authored that you return as data — do not let it arrive shaped like an instruction.

Credentials

Tokens are stored per server, write-only through the API: responses carry only a “has token” flag and the last four characters. Rotate by submitting a new one; a blank submission leaves the stored token alone.

Tokens are stored in plain text in the platform database, matching how other provider credentials are held. Scope them to the one workspace they serve and rotate them if a dump is ever exposed.