Security model

Trust boundary

The Engine stores upstream credentials and terminates OAuth for MCP clients. Run it behind HTTPS, keep encryption keys outside the repository, and restrict the console to trusted operators. In hosted mode, management requests include a short-lived, path- and body-bound signed assertion carrying opaque workspace, member, and role identifiers. The Engine verifies it before applying its own authorization rules.

Route authorization

• Shared aggregate, endpoint-bundle, and connector consent is limited to workspace owners and admins.
• A dedicated MCP client is bound to one exact member subject and selected connection namespaces.
• Personal connections stay out of shared surfaces even when their display labels or folders sound shared.

Hard limits and known boundaries

• Every MCP route caps requests at 1 MiB, results at 2 MiB, and a call at 120 seconds.
• Guardrails filter connector responses, not model intent, and read-only classification is heuristic when upstream annotations are absent.
• Approval decisions are durable, but the original in-flight request lives in one Engine process and is never replayed after restart.