MCP Security: From Vulnerable to Fortified

This project contains working examples for building secure HTTP-based AI integrations using the Model Context Protocol (MCP) with comprehensive security measures.

Overview

Learn how to secure your MCP integrations with enterprise-grade security:

• Implement OAuth 2.1 with PKCE authentication
• Configure TLS encryption and security headers
• Add comprehensive input validation and sanitization
• Implement rate limiting and DDoS protection
• Monitor security events and handle incidents
• Connect clients securely to protected MCP servers

Quick Start

For Development (no TLS):

task setup && task generate-keys
task run-oauth    # Terminal 1
task run-server   # Terminal 2

For Production (with TLS):

task setup && task generate-keys && task generate-certs
task docker-up

Prerequisites

Development Setup

• Python 3.12.9 (managed via pyenv)
• Poetry for dependency management
• Go Task for build automation
• API key for OpenAI or Anthropic (Claude) OR Ollama installed locally
• Redis server for rate limiting (optional)

Docker/Production Setup

• Docker and Docker Compose
• Valid SSL certificates for production deployment
• API key for OpenAI or Anthropic (Claude) OR Ollama installed locally

Setup

Development Setup (Local Python)

1. Clone this repository

2. Copy .env.example to .env and configure your environment:

   cp .env.example .env
   

3. Edit .env to configure security and LLM provider:

   • Set your OAuth configuration
   • Add your API keys
   • Configure Redis URL if using distributed rate limiting
   • Set TLS certificate paths

4. Run the setup tasks:

   task setup           # Install Python dependencies
   task generate-keys   # Generate RSA keys for JWT
   task generate-certs  # Generate self-signed certificates
   

Docker Setup (Production)

1. Clone this repository

2. Copy .env.example.tls to .env and configure for Docker:

   cp .env.example.tls .env
   

3. Edit .env to configure your production environment:

   • Set your API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY)
   • Configure JWT secrets and OAuth credentials
   • Set Redis password and other production settings

4. Run the Docker setup:

   task generate-keys   # Generate RSA keys for JWT
   task generate-certs  # Generate self-signed certificates
   task docker-build    # Build Docker images
   task docker-up       # Start all services with TLS
   

Supported LLM Providers

OpenAI

• Model: gpt-4.1-2025-04-14
• Client: src/secure_clients/openai_client.py
• Task: task run-openai-client
• Requires: OpenAI API key (OPENAI_API_KEY in .env)
• Features: Function calling with tool results display

Anthropic (Claude)

• Model: claude-sonnet-4-20250514
• Client: src/secure_clients/anthropic_client.py