[FR] # MCP Security and Dynamic Client Registration

[chussenot-believe]

MCP Security and Dynamic Client Registration

Description

We appreciate using SourceBot EE for its integration with LLMs and advanced code search capabilities. However, we have several security concerns around the current MCP server implementation that increase the risk of unauthorized data access, exfiltration, and could lead to supply chain compromission.

Note: SourceBot already provides audit logs (see docs), but we request enhanced coverage for MCP-specific events and alerting hooks.

• Docs: https://docs.sourcebot.dev/docs/configuration/audit-logs#audit-action-types
• MCP source: https://github.com/sourcebot-dev/sourcebot/tree/main/packages/mcp

Context and Security Concerns

With the introduction of the MCP Server, SourceBot exposes a set of tools (search_code, list_repos, get_file_source) that are extremely powerful but also carry significant security implications:

• Uncontrolled third parties - if the MCP server relays extracts (contexts, diffs, enriched prompts) to a remote LLM platform (SaaS, vendor LLM, etc.), it is possible that all or part of the code/documentation/secrets may pass through an uncontrolled third party.
• Sensitive data exfiltration – attackers can use search_code to locate secrets (e.g., passwords, API tokens, private keys) and then retrieve them with get_file_source.
• Uncontrolled discovery – list_repos makes it easy to enumerate all repositories and target sensitive ones.
• Prompt injection / confused-deputy attacks – instructions hidden in indexed files could trick an agent into exfiltrating data through MCP tools.
• Audit coverage – while audit logs exist, they should be extended with finer-grained MCP actions (tool usage, suspicious query detection) and integrated with alerting.
• Supply chain exposure – use of unpinned npm execution in the mcp.json configuration (e.g., npx -y @sourcebot/mcp@latest) increases risk of package compromise.

Proposed Solution: Hosted MCP API + Dynamic Client Registration

Overview

We propose implementing a hosted MCP API on SourceBot with Dynamic Client Registration support as defined in the MCP Authorization specification.

Key Benefits

1. No API Key Storage Required

   • Users don't need to store API keys locally
   • Eliminates risk of key leakage through configuration files
   • Reduces attack surface for credential theft

2. Granular OAuth Schema Control

   • Administrators can precisely control which OAuth schemas are authorized
   • Better compliance with enterprise AI policies
   • Example: Allow vscode:// but block cursor:// based on security requirements

3. Enhanced Security Model

   • OAuth-based authentication with proper scopes
   • Temporary access tokens with configurable expiration
   • Centralized revocation capabilities

Technical Implementation

1. Hosted MCP API

• Deploy MCP server as a hosted service on SourceBot infrastructure
• Provide secure endpoints for MCP tool access
• Implement proper authentication and authorization layers

2. Dynamic Client Registration

• Implement MCP Dynamic Client Registration protocol
• Support OAuth 2.0 authorization flows
• Enable fine-grained permission scoping

3. Enterprise Policy Controls

• Admin dashboard for OAuth schema management
• Whitelist/blacklist specific client applications
• Role-based access to different MCP tools
• Audit logging for all MCP operations

Requested Features

1. Hosted MCP API

   • Deploy MCP server as a managed service
   • High availability and scalability
   • Secure communication channels

2. Dynamic Client Registration Support

   • Implement MCP authorization specification
   • OAuth 2.0 integration
   • Client application management

3. Enterprise Policy Controls

   • OAuth schema allowlist/denylist management
   • Granular tool access permissions
   • Repository and file-level access policies

4. Query Controls

   • Built-in query filtering and result redaction for common secret patterns
   • Real-time content scanning and sanitization
   • Suspicious query detection and blocking

5. Supply Chain Protections

   • Pin MCP client dependencies
   • Provide signed releases and/or official container images
   • Regular security updates and vulnerability scanning

6. Enhanced Auditability & Alerting

   • Extend existing audit logs with detailed MCP tool usage events
   • Provide alerting hooks for suspicious activity
   • Integration with enterprise security tools

Risks by Tool

search_code

What an attacker could do:

• Run searches for secret patterns (password, token, key, BEGIN RSA PRIVATE KEY, etc.).
• Extract code snippets and identify patterns in README files or commits to manipulate LLMs (prompt injection).
• Use broad regex queries to map the entire codebase and find sensitive targets.

Impact:

• Rapid discovery of secrets, endpoints, and critical paths.
• Foundation for follow-up attacks (SSRF, cloud account takeover).

Mitigations with Hosted MCP + DCR:

• OAuth scopes limit search capabilities per client
• Server-side query validation and filtering
• Automatic redaction of results containing common secret formats
• Real-time monitoring and alerting on sensitive queries

---

list_repos

What an attacker could do:

• Enumerate all indexed repositories.
• Identify high-value repos by naming conventions (infra-, prod-, ci) and prioritize attacks.

Impact:

• Facilitates targeted attacks when combined with search_code and get_file_source.

Mitigations with Hosted MCP + DCR:

• OAuth scopes restrict repository listing permissions
• Role-based access controls limit visible repositories
• Admin policies can hide sensitive repository metadata

---

get_file_source

What an attacker could do:

• Download critical files (CI/CD pipelines, configs, scripts, dumps, backups).
• Extract credentials and historical secrets from old commits or configs.

Impact:

• Direct leakage of credentials, cloud compromise, CI/CD takeover, and loss of intellectual property.

Mitigations with Hosted MCP + DCR:

• OAuth scopes control file access permissions
• Server-side redaction before returning results
• File/repository allowlists enforced at the API level
• Real-time content scanning and sanitization

---

Implementation Roadmap

Phase 1: Hosted MCP API

• Deploy MCP server as managed service
• Implement basic OAuth 2.0 authentication
• Migrate existing API key users

Phase 2: Dynamic Client Registration

• Implement MCP authorization specification
• Add client registration and management
• Enable OAuth schema controls

Phase 3: Enterprise Features

• Advanced policy controls
• Enhanced audit and monitoring
• Integration with enterprise security tools

Conclusion

The MCP server in SourceBot must be treated as a high-risk surface. By implementing a hosted MCP API with Dynamic Client Registration, we can eliminate API key storage risks while providing administrators with precise control over client access and OAuth schemas. This approach enables secure deployment in sensitive environments while maintaining the powerful capabilities that make SourceBot valuable.

---

Sources & References

Some sources to read:

• Github MCP exploited
• MCP Github Vulnarability
• MCP the new server leak source
• Identify common security risks in MCP servers
• MCP Server Command Injection Vulnerability
• MCP Authorization Specification

[brendan-kellam]

Thx for raising - as #977, #976 have shipped, I believe we have fulfilled phase 1 & 2 as you define it (minus the OAuth schema controls). Since this issue is a bit of a catch-all and contains a lot of different features, I'm going to close it for now (we are still tracking it though).

For the enterprise features you define, we are tracking most as individual projects in Linear that fit into our larger "enterprise readiness" initiative.