Secure MCP Server

A production-ready Python MCP server with bearer token authentication, rate limiting, and secure file/HTTP tools.

Features

• Fail-closed authentication: Requires MCP_BEARER_TOKEN environment variable

• Per-session rate limiting: Token bucket algorithm prevents abuse

• Secure file operations: Path allowlist with traversal protection

• Secure HTTP operations: Domain allowlist with HTTPS-only enforcement

• Structured logging: JSON logs with automatic secret redaction

• No exposed secrets: Structured errors without stack traces

Related MCP server: FlexFS MCP

Security Model

This server provides defense-in-depth for MCP tool access, but is not a kernel-level sandbox. It:

• ✅ Validates bearer tokens (fail-closed)

• ✅ Enforces path and domain allowlists

• ✅ Blocks path traversal attempts

• ✅ Enforces file size limits

• ✅ Rate limits per session

• ❌ Does NOT provide process isolation

• ❌ Does NOT protect against malicious code execution

Installation

Using uv (recommended)

git clone https://github.com/RanaPriyansh/secure-mcp-server.git
cd secure-mcp-server
uv pip install -e ".[dev]"

Using pip

git clone https://github.com/RanaPriyansh/secure-mcp-server.git
cd secure-mcp-server
pip install -e ".[dev]"

Usage

Running the Server

export MCP_BEARER_TOKEN="your-secret-token"
export MCP_ALLOWED_PATHS="/tmp:/var/log"
export MCP_ALLOWED_DOMAINS="example.com:api.github.com"
python -m secure_mcp_server

Configuration

All configuration is via environment variables:

Tools

read_file

Read file contents from allowed paths.

{
  "path": "/tmp/example.txt"
}

list_directory

List directory contents from allowed paths.

{
  "path": "/tmp"
}

fetch_url

Fetch HTTPS URLs from allowed domains.

{
  "url": "https://api.github.com/repos/owner/repo"
}

Testing

Run the test suite:

pytest

Run with coverage:

pytest --cov=secure_mcp_server --cov-report=html

All tests pass on a fresh clone without requiring:

• Production bearer tokens (tests use fixtures)

• Real network access (HTTP tests are mocked)

• GPU or specialized hardware

• External services

Development

Install development dependencies:

pip install -e ".[dev]"

License

MIT License - see LICENSE file for details.

Author

Priyansh Rana