carbon

Least-privilege permissions

• Create separate database accounts for the MCP connector instead of using admin credentials. Grant only read or read-write access to the specific tables needed (e.g., orders, inventory) and block access to payroll, financial data, or customer contact details.
• Rotate API keys and passwords regularly—at least every 90 days. If a key is exposed, an attacker's window to steal data shrinks dramatically.
• Disable features the connector doesn't need, such as user management, report generation, or system settings access. Each enabled feature is a potential entry point.
• Document who has access and why. Maintain a simple list of which AI agents or teams can connect to Carbon and what data they're allowed to see; review quarterly and remove stale access.

Network isolation

• Run the MCP connector on a private network, not the public internet. Limit which machines can talk to it using firewalls or VPN (e.g., only from your AI application server, not from everywhere).
• Use HTTPS/TLS encryption for all connections between the connector, Carbon, and the LLM agent. Unencrypted data can be intercepted on its way across the network.
• Separate sensitive ERP data from public-facing systems. If you also run a customer portal or website, ensure it connects to a different, read-only copy of non-critical data, not the live manufacturing database.

Monitoring

• Log all MCP connector queries and results—record which data was accessed, when, and by which agent or user. Review logs monthly for suspicious patterns (e.g., unusual bulk downloads or access outside business hours).
• Set alerts for high-risk queries, such as requests for supplier contact lists, bill-of-materials (BOM), or production capacity. Alert your security team immediately if an agent tries to access data outside its normal scope.
• Check for security patches weekly. Carbon is open-source with moderate adoption; monitor the project's GitHub for updates and apply patches quickly when they appear, especially for Postgres (the database) and the REST API.
• Audit LLM outputs and logs for leaks of manufacturing details (order numbers, lot codes, customer names). If sensitive data appears in model responses, investigate whether prompts or cached data are exposing it.

Red flags to watch for

• Unexpected large data transfers from the connector—if the agent downloads thousands of inventory records or BOMs in one go, it may be attempting exfiltration; block and investigate.
• Requests for data outside the connector's declared scope—if an agent suddenly tries to access customer contact info, supplier pricing, or employee records, reject it and alert your team.
• Failed connection attempts or invalid credentials logged repeatedly. This can signal an attacker probing for weak passwords or misconfigurations.
• Slow queries or database performance degradation. Poorly designed agent queries can overload the system; monitor response times and cap query complexity to prevent denial-of-service or unintended data exposure.