security_mcp

Security

The OpenNebula MCP Server is a powerful tool that grants AI assistants direct control over your cloud infrastructure. As with any system that provides programmatic access to critical resources, security is a paramount concern. This document outlines the potential risks associated with the Model-Context-Protocol (MCP) and details the specific security measures and best practices for this project.

General MCP Security Considerations

MCP, as a protocol, introduces new potential attack vectors that users should be aware of. While the OpenNebula MCP Server is designed with safeguards, understanding the general landscape is crucial. Key risks include:

• Prompt Injection and Tool Poisoning: An attacker could craft malicious instructions hidden within tool descriptions or user prompts. If the AI model processes this, it could be manipulated into performing unintended actions.

• Command Injection: If an MCP server does not properly sanitize inputs, an attacker could inject malicious commands into parameters, potentially leading to arbitrary code execution on the server host.

• Server Spoofing and Untrusted Servers: An attacker could set up a rogue MCP server that impersonates a legitimate one to intercept data or trick users into connecting to it. It is vital to only connect to trusted, verified MCP servers.

• Over-Privileged Tools: Tools that have more permissions than they strictly need can increase the potential damage if they are compromised or misused.

• Data Leakage: Without proper controls, an AI assistant could inadvertently expose sensitive information from your infrastructure in its responses.

Security Measures in this Project

The OpenNebula MCP Server has been developed with a security-first mindset. The following controls are in place to mitigate the risks described above.

1. The ALLOW_WRITE Flag: The most critical security feature is the ALLOW_WRITE configuration flag.

   • Default Safe Mode: By default, the server runs in a read-only mode (ALLOW_WRITE=false). In this state, the AI assistant can only inspect your infrastructure (list VMs, hosts, networks, etc.) but cannot make any changes.

   • Explicit Enablement: To perform any action that modifies the state of your OpenNebula environment—such as instantiating, starting, stopping VMs, or executing commands—you must explicitly set ALLOW_WRITE=true during server startup.

   • Core Defense: This flag acts as the primary defense against unintentional or unauthorized modifications to your cloud resources.

2. Principle of Least Privilege: The tools provided by this server are designed to use the credentials of a specific OpenNebula user. The server's capabilities are therefore limited by the permissions of that user account. We strongly recommend creating a dedicated, non-oneadmin user for the MCP server with the minimum set of permissions required for its intended operations.

3. Secure Command Execution: The execute_command tool is powerful and requires special attention.

   • Gated by ALLOW_WRITE: This tool is disabled completely unless ALLOW_WRITE is set to true.

   • User Context: Commands are executed within the context of the VM's guest OS and the user configured for SSH access, not as a privileged user on the hypervisor host.

4. Deployment Best Practices: The security of the MCP server is also dependent on the environment in which it is deployed.

   • Network Isolation: Do not expose the MCP server directly to the public internet. It should be run on a trusted, private network that is only accessible to your AI client and the OpenNebula front-end.

   • Firewall Rules: Use firewalls to restrict access to the port the MCP server is running on, allowing connections only from trusted IP addresses.

   • Monitor Logs: Regularly review the server's logs for any unusual or unauthorized activity.

User Responsibility

Ultimately, you are in control of your environment. By understanding the features above and following the recommended deployment practices, you can ensure a secure and powerful integration between your AI assistant and your OpenNebula cloud.