ITWorx_MCP_Hub-Public/docs/02-security/SECURITY_INVARIANTS.md

Security Invariants

These rules override every lower-level requirement.

1. No arbitrary execution. No generic shell, command, script, or interpreter tool may be exposed.
2. No raw Docker capability. The Docker socket is mounted only into the dedicated read broker. No raw Docker API proxy exists.
3. No arbitrary file access. Every readable path is registered, canonicalized, allowlisted, and mounted read-only.
4. No unrestricted SQL. v1 has no general database query tool. Future database access must use a dedicated least-privilege account and query guard.
5. No secret retrieval. Secrets can be consumed internally but never returned, indexed, audited verbatim, or shown in UI.
6. Deny by default. Absence of an explicit binding or allow decision means deny.
7. Project and environment isolation. Every invocation is checked against both dimensions; dev access never implies prod access.
8. Connector revalidation. Each connector validates caller context and target allowlists; gateway visibility is insufficient.
9. Audience-bound tokens. A token must be issued for the Hub resource and trusted issuer. Token forwarding to unrelated services is prohibited.
10. Bounded input and output. Requests, logs, repository files, search results, and lists have strict limits and pagination.
11. Sanitized audit. Audit records identify the action without storing access tokens, passwords, private keys, connection strings, or unlimited payloads.
12. No destructive tools. v1.0 target-system capabilities are read-only. Post-v1 bounded writes must remain reversible and may not expose merge, delete, force-push, default-branch mutation or repository administration.
13. Reversible deployment. Migrations and upgrades require backup, health verification, and a tested rollback or restore path.
14. No implicit permission expansion. Adding a connector or tool does not expose it to existing clients until explicit bindings are reconciled.
15. Untrusted content remains data. Repository files, docs, logs, and MCP results may contain prompt injection; they never modify policy or authorization.

WP-160 additions

Connector and dataplane target URLs must use HTTPS and must not resolve from an unsafe IP literal or metadata/localhost hostname. The security scan is fail-closed for non-fixture secret patterns, raw Docker mounts, mutable third-party images, unsafe host/container settings, and unintended published ports.