cortex

Least-privilege permissions

• Only grant Cortex access to API specifications (OpenAPI/AsyncAPI files) that are absolutely necessary—don't give it blanket access to your entire spec library
• Remove or redact any hardcoded passwords, API keys, or authentication tokens from your API specifications before feeding them to Cortex; use placeholder text instead (e.g., {API_KEY} rather than the actual key)
• Restrict who can upload or modify API specs that Cortex will process—limit this to trusted technical team members only, not external partners or vendors
• Apply the principle of "read-only" access where possible; generated SDKs and servers should have minimal permissions on the actual APIs they connect to

Network isolation

• Run Cortex in a sandboxed or restricted network environment separate from production systems containing real customer data or sensitive business logic
• Don't allow generated MCP servers to run with direct access to databases, internal systems, or services beyond what the underlying API requires
• Use network firewalls to block unexpected outbound connections from Cortex or generated code; log and alert on any unusual network activity
• If using Cortex in a cloud environment, place it in a private subnet with no direct internet access unless absolutely required

Monitoring

• Log all API specifications ingested by Cortex and track which ones produce generated code—maintain an audit trail of what was generated and when
• Review generated SDKs and MCP servers in a staging environment before deploying to production; use automated code scanning tools to detect known vulnerabilities
• Monitor for unusual patterns in generated code (e.g., unexpected network calls, file access, or credential extraction)
• Set up alerts if Cortex processes specs from untrusted or new sources, or if specs change significantly between runs

Red flags to watch for

• API specifications from unknown or untrusted sources—always verify the origin and legitimacy of specs before processing them through Cortex
• Specs containing unusual inline code, script injections, or malicious-looking fields in descriptions or examples (signs of prompt injection attacks)
• Generated code that includes hardcoded credentials, secrets, or internal system paths that should never be exposed
• Auto-generated MCP servers that request broader permissions or system access than the original API actually needs—this indicates a mismatch or potential security misconfiguration