Security

1. MCP server security (OWASP MCP Top 10 2026, CVE-2025-6514, the Anthropic Git MCP CVE chain CVE-2025-68143/144/145)
2. Indirect prompt injection (Anthropic’s Feb 2026 system card identifies indirect injection as the dominant attack class)
3. Outbound HTTP from a server-side runtime (SSRF surged 452% from 2023 to 2024)

​

Five-gate authorization stack

MCP client
   │
   ▼  ① Inbound auth (RFC 8707-validated JWT from the MCP transport)
SkilledOpenApi meta-tools (run_workflow → enclave sandbox)
   │
   ▼     each callTool(actionId, input) inside the script:
   ▼  ② Bundle origin (signature verified, see below)
HiddenOpRegistry
   │
   ▼  ③ Per-skill ABAC (action.requiredAuthorities via AuthoritiesEngine)
   │
   ▼  ④ Credential scoping (vaultRef must resolve via the configured CredentialResolver)
OpenApiHttpExecutor
   │
   ▼  ⑤ Outbound execution (SSRF allowlist + IP blocklist + circuit breaker)
Customer REST API

​

Bundle signing (OPA model)

interface BundleIntegrity {
  alg: 'RS256' | 'EdDSA';
  keyId: string;
  signature: string;   // base64url
  digest: string;      // sha256 hex of canonical bundle bytes (excluding integrity)
}

1. Re-compute sha256 of the canonicalized bundle minus the integrity field.
2. Reject if the computed digest doesn’t match integrity.digest.
3. Look up the trusted public key by integrity.keyId. Reject if unknown.
4. Reject if the trusted key’s algorithm doesn’t match integrity.alg.
5. Verify the signature over the canonical bytes (not the digest hex) using the public key.

SkilledOpenApiPlugin.init({
  // ...
  requireSignature: true,                  // default: true. Never set false in production.
  trustedKeys: [
    {
      keyId: 'frontmcp-cloud-2026-01',
      alg: 'RS256',
      publicKeyPem: process.env.FRONTMCP_BUNDLE_PUBKEY!,
    },
  ],
})

​

RFC 8707 enforcement

• aud must equal the configured expectedAudience (typically bundleId)
• resource must equal the configured expectedResource (typically the FrontMCP server’s canonical URL)
• iss must equal expectedIssuer
• roles must include at least one of requiredRoles (default: ['frontmcp:cloud:push'])

​

Input sanitization (CVE-2025-6514 lesson)

• URL construction: WHATWG URL only, never string concat
• Path templates: reject .., backticks, $(, ${, whitespace, ?, #
• Header names: must match RFC 7230 token grammar
• Header values: stripped of CR/LF before assignment
• JSON Schema input: additionalProperties constraints applied at the Zod boundary; the executor validates input against the schema again before invoking the upstream
• No eval, Function, child_process, vm, or dynamic require anywhere in the executor or sync paths
• No bundle data in shell commands — the plugin never shells out

​

SSRF defenses (layered)

1. URL string check before DNS resolution: reject file:, data:, gopher:, ftp:; require https: (allow http: only via explicit allowHttp: true).
2. Hostname allowlist: only declared services[].baseUrl hosts.
3. Cloud-metadata hostname blocklist: metadata.google.internal, metadata.azure.com, metadata.aws.com blocked even if technically allowlisted.
4. DNS resolve once at request start; reject if any resolved IP falls in deny ranges:
   • RFC 1918 private (10/8, 172.16/12, 192.168/16)
   • Link-local (169.254/16) — blocks AWS/GCP/Azure metadata services (169.254.169.254)
   • Loopback (127/8, ::1)
   • IPv6 ULA (fc00::/7) and link-local (fe80::/10)
5. Per-host concurrency cap (maxConcurrencyPerHost, default 10).

​

ABAC integration

{
  "operationId": "refundInvoice",
  "requiredAuthorities": {
    "operator": "AND",
    "permissions": { "all": ["invoices:write"] },
    "attributes": { "match": { "input.amount": { "$lte": 10000 } } }
  }
}

​

OWASP MCP Top 10 (2026) coverage

​

Indirect prompt injection mitigations

• Structural separation: upstream responses never reach the LLM directly. Each callTool returns the action’s data into the sandboxed AgentScript, and only the script’s final return <value> (surfaced as run_workflow’s { success, value, error, stats }) is handed back to the LLM. Raw response bodies are opaque to the model unless the script explicitly extracts and returns them.
• Output schema validation as a bottleneck: every response validated against the bundle’s declared outputSchema.
• Response size cap (defaultMaxResponseBytes, default 256KB; per-op override via op.maxResponseBytes).

​

Production checklist

• dev: false (default) and requireSignature: true (default)
• At least one entry in trustedKeys[]
• Credentials wired via the auth vault instead of the in-memory MemoryCredentialResolver for any non-trivial deployment
• allowHttp: false (default) unless your upstream is on localhost
• allowPrivateNetworks: false (default) unless self-hosted on a private network
• outbound.maxConcurrencyPerHost tuned to match your upstream’s rate-limit budget
• Audit log routed to a SIEM
• SaaS-side metrics monitored to detect a stalled bundle pipeline (saas source)