How to secure an MCP server in production

1// src/auth.ts
2import * as jose from "jose";
3
4interface AuthConfig {
5  issuer: string;
6  audience: string;
7  jwksUrl: string;
8}
9
10let jwks: jose.JSONWebKeySet | null = null;
11
12export async function validateToken(
13  token: string,
14  config: AuthConfig
15): Promise<{ sub: string; scopes: string[] }> {
16  if (!jwks) {
17    const response = await fetch(config.jwksUrl);
18    jwks = await response.json();
19  }
20
21  const JWKS = jose.createLocalJWKSet(jwks!);
22
23  const { payload } = await jose.jwtVerify(token, JWKS, {
24    issuer: config.issuer,
25    audience: config.audience,
26  });
27
28  return {
29    sub: payload.sub || "unknown",
30    scopes: (payload.scope as string || "").split(" "),
31  };
32}
33
34export function requireScope(userScopes: string[], required: string): boolean {
35  return userScopes.includes(required) || userScopes.includes("admin");
36}

1// src/origin-validation.ts
2const ALLOWED_ORIGINS = new Set([
3  "https://claude.ai",
4  "vscode://cursor",
5  "https://your-app.example.com",
6]);
7
8export function validateOrigin(origin: string | undefined): boolean {
9  if (!origin) return false; // Reject missing Origin
10  return ALLOWED_ORIGINS.has(origin);
11}
12
13// Apply to HTTP/SSE transport middleware
14export function originMiddleware(
15  req: { headers: Record<string, string | undefined> },
16  res: { status: (code: number) => any; json: (body: any) => void },
17  next: () => void
18): void {
19  const origin = req.headers["origin"];
20  if (!validateOrigin(origin)) {
21    console.error(`[security] Rejected connection from origin: ${origin}`);
22    res.status(403).json({ error: "Origin not allowed" });
23    return;
24  }
25  next();
26}

1// src/sanitize.ts
2import path from "path";
3
4export function sanitizePath(basePath: string, userPath: string): string {
5  // Resolve to absolute, then verify it's within basePath
6  const resolved = path.resolve(basePath, userPath);
7  if (!resolved.startsWith(path.resolve(basePath))) {
8    throw new Error("Path traversal detected");
9  }
10  // Block hidden files and sensitive patterns
11  const parts = userPath.split(path.sep);
12  for (const part of parts) {
13    if (part.startsWith(".") && part !== "." && part !== "..") {
14      throw new Error("Access to hidden files not allowed");
15    }
16  }
17  return resolved;
18}
19
20export function sanitizeString(input: string, maxLength: number = 10000): string {
21  if (input.length > maxLength) {
22    throw new Error(`Input exceeds maximum length of ${maxLength}`);
23  }
24  // Strip null bytes
25  return input.replace(/\0/g, "");
26}
27
28export function sanitizeRegex(pattern: string): RegExp {
29  // Prevent ReDoS by limiting pattern complexity
30  if (pattern.length > 200) throw new Error("Pattern too long");
31  if (/\(.*\+.*\)\+|\(.*\*.*\)\*/.test(pattern)) {
32    throw new Error("Potentially catastrophic regex pattern");
33  }
34  return new RegExp(pattern, "i");
35}

1// src/authorized-tool.ts
2import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
3import { z } from "zod";
4import { requireScope } from "./auth.js";
5
6interface ToolAuth {
7  requiredScope: string;
8  userScopes: string[];  // Set per-connection from JWT
9}
10
11export function registerAuthorizedTool(
12  server: McpServer,
13  name: string,
14  description: string,
15  schema: Record<string, z.ZodTypeAny>,
16  auth: ToolAuth,
17  handler: (params: any) => Promise<any>
18) {
19  server.tool(name, description, schema, async (params) => {
20    if (!requireScope(auth.userScopes, auth.requiredScope)) {
21      console.error(`[auth] Denied ${name} - missing scope: ${auth.requiredScope}`);
22      return {
23        content: [{ type: "text", text: `Error: Insufficient permissions. Required scope: ${auth.requiredScope}` }],
24        isError: true,
25      };
26    }
27
28    console.error(`[auth] Allowed ${name} for user with scopes: ${auth.userScopes.join(", ")}`);
29    return handler(params);
30  });
31}

1// src/audit.ts
2export interface AuditEntry {
3  timestamp: string;
4  user: string;
5  tool: string;
6  params: Record<string, unknown>;
7  status: "success" | "error" | "denied";
8  duration_ms: number;
9}
10
11export function logAudit(entry: AuditEntry): void {
12  console.error(JSON.stringify({
13    level: "audit",
14    ...entry,
15  }));
16}
17
18// Wrap tool handlers with audit logging
19export function withAudit(
20  toolName: string,
21  userId: string,
22  handler: (params: any) => Promise<any>
23): (params: any) => Promise<any> {
24  return async (params: any) => {
25    const start = Date.now();
26    try {
27      const result = await handler(params);
28      logAudit({
29        timestamp: new Date().toISOString(),
30        user: userId,
31        tool: toolName,
32        params,
33        status: result.isError ? "error" : "success",
34        duration_ms: Date.now() - start,
35      });
36      return result;
37    } catch (error) {
38      logAudit({
39        timestamp: new Date().toISOString(),
40        user: userId,
41        tool: toolName,
42        params,
43        status: "error",
44        duration_ms: Date.now() - start,
45      });
46      throw error;
47    }
48  };
49}

1# Caddy reverse proxy configuration for MCP SSE server
2# Caddyfile
3mcp.example.com {
4  reverse_proxy localhost:3001
5  
6  header {
7    Strict-Transport-Security "max-age=31536000; includeSubDomains"
8    X-Content-Type-Options "nosniff"
9    X-Frame-Options "DENY"
10    Referrer-Policy "strict-origin-when-cross-origin"
11  }
12}
13
14# Or for Docker deployment:
15# docker run --read-only --user 1001:1001 \
16#   -e OAUTH_ISSUER=https://auth.example.com \
17#   -e OAUTH_AUDIENCE=mcp-server \
18#   mcp-server:latest