SECURITY.md•2 kB
# Security and Deployment Guide
## Is Tunneling Safe?
Tunneling (using tools like `localtunnel` or `ngrok`) exposes a port on your local machine to the public internet.
- **Risks**: Anyone with the URL can access your server. Since your server currently has no authentication, anyone can run queries against the DWR API through your machine.
- **Usage**: It is great for **development and testing**, but **NOT recommended for production** or long-term use.
## How to Run a Server in Production
Most people deploy MCP servers to a cloud provider. This offloads the work from your laptop and provides better security and reliability.
- **Options**:
- **Render / Railway / Heroku**: Easy PaaS options. You just push your code, and they give you a URL.
- **AWS Lambda / Google Cloud Run**: Serverless options that scale to zero (cheap) and are very secure.
- **VPS (DigitalOcean, EC2)**: A virtual server you manage yourself.
## Authentication (OAuth)
- **Current State**: Your server has no authentication.
- **OAuth**: Adding OAuth (e.g., "Sign in with Google") would make it much more secure. It ensures only authorized users (like you) can access the server.
- **Does it help?**: Yes, absolutely. It prevents unauthorized access.
- **Implementation**: You would typically use a middleware in your Express app (like `passport.js`) or handle auth at the infrastructure level (e.g., using an API Gateway).
## Performance on MacBook Air
- **Load**: The server itself is very lightweight. It just forwards requests to the DWR API.
- **Impact**: It won't use much CPU or RAM.
- **Constraint**: The main limitation is your internet connection and the fact that your laptop must stay awake and connected. If you close your lid, the server stops.
## Recommendation
For a more permanent and secure solution:
1. **Deploy to a cloud provider** (e.g., Railway or Render are easiest).
2. **Add basic authentication** (API Key or Basic Auth) to your Express server if you want to keep it private.