Security Review
Security Review
Section titled “Security Review”Security review for MCP Gateway is a control-by-control check of the governed MCP path. The reviewer should be able to prove identity, default deny, discovery filtering, selected-operation boundaries, credential secrecy, connector routing, session revocation, metadata-only audit, customer-controlled telemetry, and release evidence without trusting marketing claims.
Audience
Section titled “Audience”- Security reviewers approving a pilot or release candidate.
- Platform owners preparing hardening evidence.
- Docs authors checking whether a public security claim is sourced.
- Operators responding to incident-control findings.
What is this?
Section titled “What is this?”This page is the security-review checklist for public docs. It is deeper than the Security Model summary: each control maps to a source-backed verification path and a failure action. If a behavior is not sourced, mark it needs-source instead of smoothing it into public prose.
When do I use it?
Section titled “When do I use it?”Use it before publishing security docs, adding generated references, changing release evidence, or presenting deployment hardening. Use it again when a reviewer asks for a deferred capability such as full DLP, SCIM/device posture, tamper-evident audit hash chains, local STDIO governance beyond approved adapter profiles, or managed MCP hosting.
What happens?
Section titled “What happens?”- Confirm production auth mode and actor normalization.
- Prove Cedar default deny and explicit deny overriding allow.
- Prove unauthorized tools are hidden during discovery, not only denied at execution.
- Prove API-backed tools come only from selected and approved operations with host, schema, method/path, credential, timeout, and size checks before upstream.
- Prove credential broker output is opaque handles or safe refs, never secret material.
- Prove connector disable or revoke blocks routes before upstream traffic.
- Prove session revocation blocks new calls and affects active sessions according to the contract.
- Prove audit/export, telemetry, release bundles, screenshots, docs, fixtures, and PR text are metadata-only.
Review checklist
Section titled “Review checklist”| Control | What the reviewer checks | Failure action |
|---|---|---|
| Identity | OIDC/JWT, trusted proxy, SAML-through-proxy, workload identity, or local identity produces normalized actor context. | Deny discovery and calls until identity refs validate. |
| Policy | Cedar simulation shows default deny and forbid precedence. | Preserve deny and version the policy fix. |
| Discovery | Unauthorized tools are hidden from catalog/discovery. | Treat visible unauthorized tools as a release blocker. |
| Credentials | Broker resolves allowed modes without returning material. | Disable or revoke the binding and remove unsafe output. |
| Connectors | Registered private routes only; disabled or revoked routes fail closed. | Block new routes and preserve safe audit. |
| Sessions | Drain, terminate, revoke, expiry, and audit follow explicit session states. | Reject new stateful sessions or revoke affected active sessions. |
| Audit/export | Events carry policy version, credential mode, request/session IDs, reason code, redaction status. | Remove payload-bearing evidence and rerun no-secret gate. |
| Release evidence | Cosign, SBOM, provenance, backup/restore, upgrade/drain, rollback, checksums, no-secret scan. | Do not publish the release candidate until evidence validates. |
What can go wrong?
Section titled “What can go wrong?”- A public page claims ML prompt-injection detection, full DLP, SCIM/device posture, endpoint command sandboxing, tamper-evident audit hash chains, local STDIO governance outside approved adapter profiles, or managed MCP hosting as current V1 behavior. Those need source or must stay deferred/outside V1.
- A security finding is closed using a screenshot or workpad instead of source contracts, runbooks, schemas, or harness checks.
- A diagnostic includes backend details, payloads, prompts, responses, tokens, credential material, or customer data.
- A connector, credential, policy, or session revocation does not fail closed before upstream execution.
- Release artifacts include private material or generated local outputs that were never curated for public release.
Source truth
Section titled “Source truth”- Read Identity, Policy, Credentials for access-chain review.
- Read Connectors and Private Routing for private connectivity review.
- Read Release Evidence for package and no-secret review.
Type set in Geist, Source Serif 4, and Departure Mono.