MCP server security, held to the protocol's own bar
audytx exposes its non-AI precision engine to coding agents as a Model
Context Protocol (MCP) server at POST /mcp — AWS Terraform and CloudFormation review at code-time, invoked by the very agent
that wrote the code. This page maps it, control by control, to the NSA MCP guidance and the OWASP MCP Top 10.
The NSA's Cybersecurity Information Sheet “Model Context Protocol (MCP): Security Design Considerations” (U/OO/6030316-26, May 2026) lists security design controls for MCP. This page maps the audytx server to them.
Required where MCP leaves it optional
MCP's own spec makes authentication optional and leaves egress, input screening, and tool integrity underspecified. audytx makes authentication required on every tool call, validates all input against strict schemas, limits outbound requests to one opt-in path, and stays stateless.
Every control, mapped to a source
Each row is one NSA CSI control, exactly how audytx implements it, and the OWASP MCP Top 10 item it answers.
| NSA CSI control | How audytx implements it | OWASP |
|---|---|---|
| Require authentication & verify identity MCP leaves auth optional; verify who is calling. |
Every tools/call requires a Client ID: a UUID minted at /dashboard, sent as either the X-Client-ID header or a standard Authorization: Bearer header. It is shown once when you create it and can be revoked from the dashboard. Auth failures return a real 401 with a WWW-Authenticate header naming the RFC 9728 metadata document at /.well-known/oauth-protected-resource, per the MCP 2025-06-18 authorization spec. Discovery (initialize/tools/list/ping) stays open by design: it returns no data. Transport is HTTPS. |
MCP01 |
| Validate every input against a schema Block malformed, missing, or oversized fields. |
Each tool declares a strict JSON inputSchema. Server-side, file paths are checked against an allowlist and must end .tf/.tfvars (Terraform tools) or .json/.yaml/.yml/.template (scan_cloudformation); inputs are capped at 2,000 files / 50 MB total / 4,000 resources; oversized requests are rejected; JSON-RPC batching is refused. |
MCP05 |
| Pin resource URLs / control egress Prevent SSRF; keep data local; filter outbound. |
Most tools make no outbound requests. The engine is sandboxed and network-free, and the optional plan input is passed inline, never fetched. The one outbound path is the opt-in autofix → pull request flow (shared by the Terraform and CloudFormation autofix tools): it calls GitHub's API at a fixed address, using the caller's own token. See Outbound requests and SSRF below. |
MCP02 |
| Tool-definition integrity (anti rug-pull) Detect silent changes to tool descriptions. |
audytx is a server, not a client: its tool definitions are static, compiled into the binary, versioned per release, and changed only through an auditable git push that redeploys the server. They can't mutate between sessions. The rug-pull the NSA warns about isn't a move this server can make. | MCP03 |
| Context-poisoning defense Don't let tool output be read as instructions. |
The initialize response explicitly instructs the calling agent that every string echoed from analyzed Terraform or CloudFormation (resource names, attribute values, messages) is untrusted data, never instructions. This is guidance to the agent: it lowers the risk of a malicious .tf file or template steering the agent, but the agent decides whether to follow it. |
MCP03 |
| Least privilege / sandboxing Run tools with the least access they need. |
The engine runs inside a sandbox — no filesystem, no ambient network egress. The read tools are pure functions of their input (readOnlyHint: true, openWorldHint: false). The server holds no AWS or cloud credentials; it only analyzes text. |
MCP05 |
| Human-in-the-loop for actions Require review before state-changing actions. |
The only state-changing tools — autofix_terraform and autofix_cloudformation — commit to a new branch and open a pull request (a human merge gate). dry_run_autofix returns the exact unified diff for preview first. Write-path checks reject output that does not match the files you sent. |
MCP03 |
| Logging & observability Log calls with identity and parameters. |
Successful authenticated tool calls record an event with the calling identity, API-token id, source IP, and tool name — but deliberately not the analyzed Terraform or CloudFormation content (data minimization). The findings of a scan (rule, message, resource, file and lines) are kept for 90 days, then deleted. Quota usage is tracked only for accepted scan operations; non-scan helpers are free. | MCP08 |
| Rate limiting / abuse resistance Bound request volume and cross-origin abuse. |
120 calls/minute per IP plus the monthly scan quota of your plan (Free: 100 scans); oversized bodies are rejected early; browser cross-origin Origin headers are refused (CSRF / DNS-rebinding hygiene, per the MCP spec's recommendation). |
— |
| Supply-chain pinning Pin versions; verify; avoid runtime fetch. |
All dependencies are pinned to an exact lockfile; the build toolchain is pinned to an exact version; module security models are vendored at build time (no runtime registry fetch); deploys are reproducible from git. | MCP04 |
| Data classification / no context bleed Isolate trust zones; prevent cross-session leakage. |
The server is stateless — no session state, so one caller's code cannot bleed into another caller's request; each POST is an independent pure function of its arguments. | MCP02 · MCP10 |
Outbound requests and SSRF
SSRF requires coercing the server into requesting a host of the attacker's choosing. This section describes where the server makes outbound requests. The written SSRF review is Planned before the 1 November launch.
Most tools make no outbound request
scan_terraform, scan_cloudformation, scan_workspace, dry_run_autofix, dry_run_autofix_cloudformation, explain_finding, get_context_graph, and cost_sampler parse inline content and run the sandboxed engine. The optional plan input is passed inline (a JSON object or string), never a URL the server fetches.
The one outbound path
autofix_terraform and autofix_cloudformation open a pull request only when the caller supplies both a github_token and a repo. Requests go to GitHub's API at a fixed address in the code; the caller's repository name is used only in the URL path.
The caller's own token
That path uses the caller's own GitHub token, not a credential of audytx's own.
The written SSRF review is Planned before the 1 November launch.
Server scope, by design
Two items in the NSA guidance are deployment-side controls that belong to the operator,
not to a single server. audytx is a single, published TLS endpoint at audytx.com/mcp.
Shadow-server discovery
Scanning your network for unapproved MCP listeners is an operator control that lives in your environment, not in a single published endpoint.
SIEM ingestion
Forwarding MCP logs into your SIEM is likewise yours to own. Everything else on this page is a control the audytx server owns and enforces itself.
This posture reflects the engine version reported at /status. To report a security issue, see security.txt.
Frequently asked questions
Is authentication required to call the audytx MCP server?
Yes. Every tools/call requires a Client ID — a UUID minted at /dashboard, sent as either an X-Client-ID header or a standard Authorization: Bearer header. It is revocable from the dashboard. Discovery methods (initialize, tools/list, ping) stay open by design because they return no data.
Is the audytx MCP server vulnerable to SSRF?
The written SSRF review is Planned before the 1 November launch. By design, most tools make no outbound request, and the one outbound path — the opt-in autofix pull request, shared by the Terraform and CloudFormation autofix tools — calls GitHub's API at a fixed address using the caller's own token.
Is my Terraform or CloudFormation code stored?
Not the file contents. The findings of a scan (rule, message, resource, file and lines) are kept for 90 days, then deleted. Every successful tool call also records the calling identity, API-token id, source IP, and tool name, but not the analyzed content (data minimization). The server holds no AWS or cloud credentials and only analyzes text.
Is the audytx MCP server stateless?
Yes. The audytx MCP server keeps no session state, so one caller's code cannot bleed into another caller's request; each POST is an independent pure function of its arguments.
Start free
Install on GitHub, point your agent at the MCP server, and see the findings on your next pull request. The Free plan includes 100 scans a month, and the free tier is here to stay.
Sources: NSA CSI Model Context Protocol: Security Design Considerations (U/OO/6030316-26, May 2026) · OWASP MCP Top 10.