ai-agent-book

Security Hardening Guide: ai-agent-book MCP Connector

Least-privilege permissions

• Run the MCP connector in a container or VM with minimal capabilities; restrict file system access to only directories containing book content and example code
• Use a dedicated service account with no administrative privileges; block access to system credentials, environment variables containing API keys, and sensitive configuration files
• When executing example code from chapters, sandbox each execution with resource limits (CPU, memory, disk I/O); disable network access unless explicitly required by the specific example
• Review and restrict permissions for any example handling external API calls before deploying to production environments

Network isolation

• Deploy the connector behind a firewall with explicit allow-lists for only required endpoints; block outbound connections by default
• If examples make API requests (LLM providers, external services), use a proxy or gateway to audit and control traffic; never allow direct credential transmission in URLs or headers
• Isolate the connector from production systems and data pipelines; use separate networks for development, testing, and any production use
• Disable or restrict access to example code that includes web scraping, HTTP clients, or shell command execution until thoroughly reviewed

Monitoring

• Log all code execution, including which chapter examples are run, input parameters, and output; retain logs for audit trails and incident investigation
• Monitor dependency updates in package.json and requirements.txt files across all chapters; set up alerts for known CVEs in dependencies before running examples
• Track and alert on unusual patterns: repeated failed API calls, unexpected file system access, high memory/CPU usage, or attempts to modify example code
• Regularly scan the repository and local copies for secrets (API keys, tokens) using automated scanning tools; flag any credentials found in plaintext

Red flags to watch for

• Example code or dependencies with unmaintained upstream projects or missing security contacts; cross-reference with CVE databases and GitHub security advisories before use
• Chapter examples that execute arbitrary code (e.g., eval(), shell commands, dynamic imports) without explicit sandboxing or validation of input
• Hardcoded credentials, API endpoints, or configuration in example code; require environment-variable substitution or secure credential stores before production deployment
• Missing or outdated documentation on how examples handle sensitive data (API responses, user inputs, model outputs); treat undocumented data flows as a security risk until clarified