MCP Security

Overview

MCP security centers on protecting API credentials, scoping access, and ensuring data boundaries. The MCP server is a pass-through; it does not add its own auth layer. Security is enforced by the DMTR API and by how you configure and deploy the server.

Authentication

Use API keys with least privilege. Prefer scoped keys (read-only for query-only use cases). Store keys in environment variables or secret managers; never in config files or code. Rotate keys periodically. For multi-tenant deployments, use separate keys per tenant or OAuth with user context.

Data boundaries

The MCP server forwards requests to DMTR. Data boundaries are defined by the DMTR API: org, workspace, and participant scope. The server does not cache or persist data. Ensure your MCP client does not leak data to third-party LLM providers; use self-hosted or privacy-preserving LLM options for sensitive data.

Audit

All DMTR API calls are audited. Audit logs include: caller (API key), action, resource, timestamp. Use DMTR audit export for compliance. The MCP layer does not add separate audit; it relies on DMTR. Enable request logging in the server for operational debugging (without logging sensitive fields).

Best practices

• Use sandbox keys for development. Use production keys only in production.
• Restrict network access to the MCP server (firewall, VPC).
• Use TLS for HTTP transport. Validate certificates.
• Limit tool exposure: if a client only needs read, use a read-only API key.
• Monitor for anomalous usage (unusual request patterns, high volume).