paperbanana

PaperBanana MCP Connector Security Hardening Guide

Least-privilege permissions

• Restrict API credentials: Only grant access to figure/diagram generation endpoints—avoid broad "admin" keys. If using cloud services (AWS, Azure, etc.), create separate restricted accounts for PaperBanana alone.
• Isolate file access: Limit where the tool can read descriptions and write outputs. Use separate folders for input and output; prevent access to sensitive company documents or employee directories.
• Control user input levels: Only allow trusted team members to submit figure requests. If open to broader users, require review before processing unusual or suspicious descriptions.
• Separate sandbox credentials: If using multiple backend services (rendering, storage, logging), use different API keys for each—so one compromised key doesn't unlock everything.

Network isolation

• Route through VPN or internal gateway: Ensure all communication between your systems and PaperBanana backends goes through company network controls, not directly over the internet.
• Disable external logging by default: Verify that generated figures and their specifications aren't automatically sent to the vendor's servers or third-party analytics platforms; disable telemetry if available.
• Whitelist backend destinations: If PaperBanana connects to external AI or rendering services, lock down which servers it can reach—block anything unnecessary.
• Audit API call logs: Keep records of every request sent and response received; check quarterly for unexpected destinations or unusual data volumes.

Monitoring

• Track figure submissions and outputs: Log what descriptions users submit and what figures are generated. Watch for patterns suggesting someone is testing system boundaries.
• Alert on failed requests or errors: Set up notifications if the tool encounters authentication failures, denied connections, or processing errors—these can signal misuse or compromise.
• Review generated content regularly: Spot-check outputs for signs of injection attacks (e.g., figures containing unexpected text, code, or links) or data leakage.
• Monitor credential usage: If using API keys, check that they're only called from expected internal systems and at normal frequency; sudden spikes or calls from unknown IPs suggest exposure.

Red flags to watch for

• Unusual figure requests: Descriptions containing code snippets, system commands, or requests for "hidden" or "debug" content suggest injection attempts.
• Requests for sensitive data in outputs: Users asking the tool to render employee lists, financial data, or internal process flows in figures (which could create audit trails or export paths).
• Unexplained external network traffic: Your IT team reports PaperBanana connecting to unknown services or transmitting large data volumes not matching normal figure sizes.
• Tool not logging activity or logs going missing: If audit trails disappear, are inconsistent, or show gaps, investigate immediately—could mean tampering or data exfiltration.