hyperframes

Least-privilege permissions

• Restrict the MCP connector to a dedicated sandbox user account with no shell access or home directory permissions
• Whitelist only specific file paths and directories the connector needs; deny access to /etc, /home, credential stores, and secrets management systems
• Limit API calls to HeyGen services only; block outbound connections to arbitrary external endpoints
• Disable local file system write access unless explicitly required; use temporary directories with automatic cleanup policies

Network isolation

• Run the Hyperframes connector in a network-isolated container or VM with egress rules limited to HeyGen API endpoints only
• Implement an egress proxy to inspect and log all outbound traffic; block data transfers to unexpected domains
• Disable access to internal metadata services (e.g., cloud provider credential endpoints) and local network discovery
• Use a firewall rule to prevent the connector process from accessing localhost services or inter-process communication channels

Monitoring

• Log all HTML/video rendering requests with full payloads; alert on unusually large or repeated rendering calls
• Monitor for JavaScript execution attempts, DOM manipulation, or attempts to access window/document objects in rendered content
• Track file access patterns and flag reads from sensitive directories or credential files
• Set up alerts for unexpected outbound connections, failed authentication attempts to HeyGen, or version changes in HeyGen dependencies

Red flags to watch for

• HTML input containing <script>, fetch(), XMLHttpRequest, or event handlers (onclick, onerror, onload); reject these patterns before rendering
• Video URLs pointing to internal/private IP ranges, localhost, or services unrelated to HeyGen
• Agents rendering content derived directly from uncleaned user input without intermediate validation
• Unusual data volumes exfiltrated in video metadata or rendering requests; correlate with sensitive data access logs