MCP / Platform engineers
Use MCP as an evidence gateway, not an unrestricted agent back door
A secure pattern for API-key authentication, ZIP ingestion, structured evidence, provenance, and bounded audit actions through MCP.
MCP
Follow identity and data across the boundaries that matter.
Reachable paths are explained
An MCP server is safest when it exposes narrow evidence and workflow contracts, not a shell with a friendlier protocol.
Define the trust boundary before the tools
An MCP client may run on a developer laptop, in CI, or inside another agent. Treat it as an external integration. Authenticate it with an expiring workspace-scoped API key, limit scopes to the required operations, validate origin and payload limits, and log every accepted action.
The server should expose a small set of typed operations such as uploading a ZIP, submitting evidence, starting an audit, reading status, and retrieving approved output. General shell, arbitrary file access, and unrestricted internal API forwarding do not belong in the contract.
Repository content is data, not instruction
A ZIP, manifest, README, source comment, or generated artifact can contain adversarial instructions. The ingestion pipeline must handle that material as untrusted evidence. Archive validation, path containment, decompression limits, file count limits, type checks, secret masking, and deterministic scanners run before model interpretation.
- Bind the upload to one workspace and immutable digest.
- Reject traversal paths, links, oversized archives, and decompression bombs.
- Store provenance and source identity separately from derived claims.
- Require explicit authorization again before a consequential action.
Make every submitted fact explainable
Structured evidence should include entity, relationship, source, observed time, confidence, and an immutable evidence identifier. The architecture model can reconcile it with code, cloud, CI/CD, scanner, and human observations without letting the MCP client declare canonical truth by itself.
Design for revocation and audit
Show the token once, store only its digest, support expiry and revocation, and attach a clear scope preset for MCP automation. Durable events should record accepted, queued, running, completed, failed, and cancelled states so the client can recover without repeating a mutation.