Secure MCP Server

A Python MCP server with bearer token authentication, rate limiting, and allowlisted file/HTTP tools.

What This Is

Bearer auth + token-bucket rate limiting + path/domain allowlists for MCP tools. Fails closed: won't start without MCP_BEARER_TOKEN.

Related MCP server: FlexFS MCP

What This Is NOT

Not a sandbox. This runs in your process space with your privileges. It will:

• ✅ Block requests without valid bearer token (fail-closed at startup)

• ✅ Rate-limit requests per session (token bucket)

• ✅ Enforce path and domain allowlists

• ✅ Block path traversal and symlink escapes

• ✅ Enforce file size limits

• ✅ Redact secrets from logs

But it will not:

• ❌ Provide process isolation or syscall filtering

• ❌ Prevent execution of malicious code in tool paths

• ❌ Protect against kernel exploits

• ❌ Stop filesystem access outside Python (if attacker gets code exec)

• ❌ Prevent memory corruption attacks

Threat model: A misbehaving MCP client that follows the protocol but tries to read/write wrong paths or hit wrong domains. Not a defense against arbitrary code execution or kernel-level attacks.

Installation

Using uv (recommended)

git clone https://github.com/RanaPriyansh/secure-mcp-server.git
cd secure-mcp-server
uv pip install -e ".[dev]"

Using pip

git clone https://github.com/RanaPriyansh/secure-mcp-server.git
cd secure-mcp-server
pip install -e ".[dev]"

Usage

Running the Server

export MCP_BEARER_TOKEN="your-secret-token"
export MCP_ALLOWED_PATHS="/tmp:/var/log"
export MCP_ALLOWED_DOMAINS="example.com:api.github.com"
python -m secure_mcp_server

Configuration

All configuration is via environment variables:

Tools

read_file

Read file contents from allowed paths.

{
  "path": "/tmp/example.txt"
}

list_directory

List directory contents from allowed paths.

{
  "path": "/tmp"
}

fetch_url

Fetch HTTPS URLs from allowed domains.

{
  "url": "https://api.github.com/repos/owner/repo"
}

Testing

Run the test suite:

pytest

Run with coverage:

pytest --cov=secure_mcp_server --cov-report=html

Tests run in-process with fixtures. No GPU, no network, no production secrets needed.

Development

Install development dependencies:

pip install -e ".[dev]"

License

MIT License - see LICENSE file for details.

Author

Priyansh Rana