Security

Security

Automatic PII and Secret Redaction

All data returned by every tool is automatically sanitized before reaching your AI assistant. The following patterns are detected and replaced with [REDACTED_<TYPE>]:

Type	Example
Credit card numbers	Visa, Mastercard, Amex, Discover
Social Security Numbers	123-45-6789
AWS access keys	AKIA...
AWS secret keys	aws_secret_access_key=...
Generic API keys and tokens	api_key=..., access_token=...
Passwords in logs	password=..., pwd=...
JWT tokens	eyJ...
Bearer tokens	Bearer abc123...
Private IP addresses	RFC 1918 ranges (10.x, 172.16–31.x, 192.168.x)
Email addresses	user@example.com
Phone numbers	US format
Kubernetes secret data	Base64-encoded data: blocks
Database connection strings	postgres://, mongodb://, redis://, etc.
OTLP span attributes	Sensitive keys (password, secret, token) in trace spans

Sanitization is enabled by default and controlled by MCP_ENABLE_SANITIZATION.

Network Policy

The Helm chart deploys a NetworkPolicy restricting all egress to only:

Destination	Port	Purpose
Loki	3100	Log queries
Prometheus	9090	Metric queries
Tempo	3200	Trace queries
DNS	53	Name resolution
AWS endpoints	443	Marketplace metering

No other outbound connections are permitted.

RBAC

The server's Kubernetes ServiceAccount has no Kubernetes API permissions. It communicates exclusively with the observability stack over HTTP. It cannot read secrets, list pods, or perform any cluster operations.

Container Security

• Runs as non-root user (mcp)
• Read-only filesystem
• No source .py files in the image (bytecode only)
• Minimal base image (python:3.11-slim)

Read-Only

All 12 tools are read-only. There are no write, delete, or mutation operations of any kind.

License Enforcement

• AWS Marketplace RegisterUsage is called at startup and every hour
• Response signature is verified on every call
• License check cannot be disabled at runtime in production