Company Secure Python MCP

This is a clean-room-designed minimal MCP server intended for use only from Copilot Studio. It does not reuse code from the old m365-copilot-companion-mcp. Treating the audit report in the parent directory as negative requirements, the feature set has been reduced to six tools.

Its current positioning is a "security-reviewable reference implementation." Do not deploy it to production until you have configured a dedicated VM or dedicated rootless Docker, Entra ID, TLS termination, key ACLs, an internal registry, and DLP/SIEM, and completed real Docker integration testing.

Features provided

Email, calendar, clipboard, registry, ODBC, web fetching, arbitrary URLs, Shell, PowerShell, package installation, self-update, auto-start, browser automation, Tool Forge, tunnels, and generic tool relay are not implemented.

Related MCP server: AI Workspace MCP Server

Trust boundary

flowchart LR
    CS[Copilot Studio] -->|OAuth 2.0 delegated token / TLS| RP[Reverse proxy / WAF]
    RP -->|loopback or private hop| MCP[6-tool MCP service]
    MCP -->|JWKS only| ENTRA[Microsoft Entra ID]
    MCP -->|scoped access| WS[Per-user workspace]
    MCP -->|immutable request| Q[Control queue]
    REVIEW[Separate reviewer account] -->|Ed25519 signed approval| Q
    Q -->|one-time claim| RUN[Dedicated/rootless Docker runner]
    RUN -->|network=none / read-only / limits| JOB[Python container]
    JOB -->|declared UTF-8 outputs only| WS
    MCP -->|HMAC chain; no content| AUDIT[Audit log -> SIEM]

The approval private key is not passed to the MCP service. The MCP service holds only the approval public key and the audit key. Python code is not executed with the host Python, and there is no fallback to local execution.

Documents to read first

• Security Design Report

• Deployment Guide

• Threat Model

• Security Test Plan

• Vulnerability Response Policy

Verification in the development environment

python -m venv .venv
.\.venv\Scripts\python.exe -m pip install uv
.\.venv\Scripts\uv.exe sync --frozen --extra dev
.\scripts\Invoke-SecurityChecks.ps1 -PythonExecutable .\.venv\Scripts\python.exe

In production, do not install directly from PyPI on the internet; use an approved internal mirror and the pinned hashes in requirements.lock. uv.lock also pins the development and verification environments. .env is not loaded. Configuration is passed from the service management platform to the process environment.

Python job contract

• Input: /work/input/manifest.json and /work/input/<固定名> (read-only)

• Output: /work/output/<python_prepareで宣言したファイル名>

• Public name: created as a new file in the user's own output as <request-id>-<連番>.<拡張子> to prevent collisions

• Output formats: UTF-8 .txt, .md, .csv, .json

• Standard output and standard error: discarded and not returned to the model

• Network: none

• Execution time: 60 seconds by default, 300 seconds maximum

• Memory: 256 MiB, CPU: 1, PID: 64

The AST import allowlist is defense in depth and is not considered a Python sandbox. The actual boundary is out-of-band approval and OS isolation via a dedicated VM/rootless Docker.

If successful docker rm -f cannot be confirmed at timeout, the runner is placed in a quarantine state, all subsequent Python executions are refused, and the execution directory is preserved. It will not resume until an operator destroys and rebuilds the dedicated VM.