metamcp

Least-privilege permissions

• Restrict credentials to what's needed: Give MetaMCP access only to the specific MCP servers it must reach—not all company systems. Store passwords and API keys in encrypted vaults (tools like HashiCorp Vault), not in plain text files.
• Use separate accounts per integration: Create dedicated user accounts for each MCP connector instead of reusing admin credentials. If one account leaks, only that connection is compromised.
• Limit Docker container privileges: Run the MetaMCP container with minimal system permissions (non-root user). Prevent it from accessing the host machine's core systems or other containers without explicit need.
• Audit who accesses MetaMCP: Maintain a log of which team members and applications can request work from MetaMCP. Review this monthly and revoke access for departed staff immediately.

Network isolation

• Keep MetaMCP on a separate internal network: Place the Docker container on a private network segment that cannot reach the public internet directly. Use a firewall to allow only approved traffic between MetaMCP and MCP servers.
• Encrypt all connections: Require TLS/SSL encryption (HTTPS) for all communication to and from MetaMCP—both inbound requests and outbound calls to MCP servers. Never allow unencrypted traffic.
• Block unexpected outbound traffic: Configure the firewall to prevent MetaMCP from connecting to any external servers unless explicitly approved. This stops malicious code from "phoning home."
• Use a reverse proxy or gateway in front: Place MetaMCP behind a managed security appliance that filters suspicious requests, logs all traffic, and can block known attack patterns.

Monitoring

• Log every request and routing decision: Keep detailed records of who asked for what, which MCP server handled it, and what data was returned. Store logs securely for at least 90 days and review them weekly for unusual patterns.
• Set up real-time alerts for anomalies: Configure automated notifications if MetaMCP receives malformed requests, routes queries to unexpected destinations, or processes unusually large data volumes in short time.
• Monitor container health and resource use: Watch for signs of compromise such as unexpected CPU spikes, memory leaks, or failed restart loops. These may indicate an attacker is running malicious code inside MetaMCP.
• Track MetaMCP version and plugin updates: Document what version you're running and which middleware extensions are installed. When security patches are released, test and apply them within two weeks.

Red flags to watch for

• Unexplained data returned from queries: If a request to one MCP server suddenly returns data that should come from a different system, this suggests routing injection—stop using MetaMCP immediately and investigate.
• Slow or stalled responses with high error rates: Frequent timeouts and failures may indicate the container is under attack or misconfigured. Take MetaMCP offline and audit its recent activity logs.
• Third-party middleware from unknown sources: Do not install plugins or extensions from developers you haven't vetted. Before adding any custom middleware, require the vendor to provide security documentation and confirm it doesn't capture or exfiltrate queries.
• **No