mcporter

Least-privilege permissions

• Restrict server access: When connecting MCP servers, only enable the specific data sources and actions your AI needs. Think of it like giving a contractor access only to the rooms they need to work in, not the entire building.
• Limit API capabilities: Review each connected server's permissions and disable unused features (e.g., if you only need read access to data, disable delete or write permissions).
• Use separate accounts: Create dedicated, limited accounts for each MCP server connection rather than reusing admin or shared credentials.
• Rotate credentials regularly: Change API keys and passwords for connected servers every 90 days, or immediately if a staff member leaves.

Network isolation

• Keep credentials out of code: Never store API keys, passwords, or secrets in configuration files that are shared or stored in version control systems (GitHub, GitLab, etc.). Use password managers or environment variable management tools instead.
• Limit who can access mcporter: Only allow authorized team members to install, configure, or update the mcporter tool on work devices.
• Audit connections: Maintain a list of which MCP servers are connected and why. Review and remove unused connections quarterly.
• Test in sandbox first: Before connecting any new MCP server to production, test it in an isolated, non-critical environment to verify it behaves as expected.

Monitoring

• Log all requests and responses: Enable logging for all data exchanged between mcporter and connected servers. Review logs weekly for unusual activity.
• Set up alerts for suspicious activity: Configure alerts if an MCP server returns unexpected data sizes, error rates spike, or requests originate from unusual locations.
• Track software updates: Monitor for new versions of mcporter and its dependencies. Test updates in a non-production environment before deploying to production.
• Document baseline behavior: Record what normal, day-to-day activity looks like so you can spot deviations (e.g., unusual query patterns or data requests).

Red flags to watch for

• Unverified or unsigned updates: If mcporter or a connected server releases an update without clear release notes or security information, delay installation and investigate first.
• Unexpected data returned: If an MCP server returns data that doesn't match what you requested or includes information you didn't ask for, stop using it and investigate.
• Sudden increase in errors: A spike in connection errors or timeouts may indicate a compromised server or network interference.
• Missing or vague security documentation: If a connected MCP server has no published security practices, privacy policy, or audit trail, treat it as high-risk and restrict its permissions further.