MCP Security: Model Context Protocol Authorization

import { Client } from "@modelcontextprotocol/sdk/client/index.js"
import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js"

// Route MCP traffic through Veto's authorization gateway
const vetoGatewayUrl = "https://api.veto.so/v1/mcp/default"
const apiKey = process.env.VETO_API_KEY

const transport = new SSEClientTransport(
  new URL(vetoGatewayUrl),
  {
    headers: {
      "X-Veto-API-Key": apiKey,
    },
  }
)

const client = new Client(
  { name: "my-mcp-client", version: "1.0.0" },
  { capabilities: {} }
)

await client.connect(transport)

// List available tools (Veto filters based on policy)
const tools = await client.listTools()
console.log("Authorized tools:", tools)

// Call a tool (Veto evaluates before forwarding)
const result = await client.callTool({
  name: "read_file",
  arguments: { path: "/data/report.csv" }
})

interface ToolDefinition {
  name: string
  description: string
  inputSchema: JSONSchema
  // Potentially malicious fields from untrusted server
  annotations?: Record<string, unknown>
}

class ToolPoisoningPrevention {
  /**
   * Detect potential tool poisoning by comparing declared vs actual behavior.
   * Defense-in-depth against malicious MCP servers.
   */
  private trustedToolSignatures: Map<string, ToolSignature>

  validateToolDefinition(tool: ToolDefinition): ValidationResult {
    const errors: string[] = []

    // 1. Check against trusted signature (pinned on first use)
    const trusted = this.trustedToolSignatures.get(tool.name)
    if (trusted) {
      if (tool.description !== trusted.description) {
        errors.push(`Description mismatch for ${tool.name}. Tool may have been modified.`)
      }
      if (JSON.stringify(tool.inputSchema) !== JSON.stringify(trusted.inputSchema)) {
        errors.push(`Input schema changed for ${tool.name}. Verify with server operator.`)
      }
    }

    // 2. Detect suspicious description patterns
    const suspiciousPatterns = [
      /send.*email.*draft/i,      // Claims draft but might send
      /delete.*backup/i,           // Hides destructive action
      /read.*password/i,           // Attempts credential theft
      /forward.*to.*external/i,    // Data exfiltration risk
    ]

    for (const pattern of suspiciousPatterns) {
      if (pattern.test(tool.description)) {
        errors.push(`Suspicious pattern in tool description: ${pattern.source}`)
      }
    }

    // 3. Enforce least-privilege annotations
    if (tool.annotations?.readOnlyHint !== true && this.isWriteTool(tool.name)) {
      errors.push(`Tool ${tool.name} performs writes but lacks readOnlyHint=false`)
    }

    return {
      valid: errors.length === 0,
      errors,
      recommendation: errors.length > 0 ? 'Block tool until verified' : 'Allow'
    }
  }

  // Register trusted tools after verification
  pinToolSignature(tool: ToolDefinition, verifiedBy: string): void {
    this.trustedToolSignatures.set(tool.name, {
      name: tool.name,
      description: tool.description,
      inputSchema: tool.inputSchema,
      pinnedAt: new Date(),
      verifiedBy
    })
  }
}

import { randomBytes, createHmac } from 'crypto'

interface OAuthStatePayload {
  sessionId: string          // MCP session identifier
  toolName: string           // Tool that triggered OAuth
  requestId: string          // Unique request correlation ID
  redirectUri: string        // Where to send the user after auth
  expiresAt: number          // Unix timestamp
}

class MCPAuthStateManager {
  private secret: Buffer
  private stateCache: Map<string, OAuthStatePayload>

  constructor(secret: string) {
    this.secret = Buffer.from(secret, 'utf-8')
    this.stateCache = new Map()
  }

  /**
   * Generate an OAuth state parameter bound to the MCP context.
   * Prevents CSRF attacks on OAuth callbacks.
   */
  generateState(payload: OAuthStatePayload): string {
    const nonce = randomBytes(16).toString('hex')
    const stateData = JSON.stringify({ ...payload, nonce })

    // Create HMAC signature for integrity
    const signature = createHmac('sha256', this.secret)
      .update(stateData)
      .digest('hex')

    const state = Buffer.from(JSON.stringify({
      data: payload,
      nonce,
      sig: signature.substring(0, 32)  // First 32 chars of HMAC
    })).toString('base64url')

    // Cache for verification
    this.stateCache.set(state, { ...payload, expiresAt: Date.now() + 300000 }) // 5 min TTL

    return state
  }

  /**
   * Verify and decode OAuth state, ensuring it matches the expected context.
   */
  verifyState(state: string, expectedSessionId: string): OAuthStatePayload | null {
    const cached = this.stateCache.get(state)
    if (!cached) {
      console.error('State not found in cache - possible replay attack')
      return null
    }

    // Verify session binding
    if (cached.sessionId !== expectedSessionId) {
      console.error('Session ID mismatch in OAuth state')
      return null
    }

    // Check expiration
    if (Date.now() > cached.expiresAt) {
      this.stateCache.delete(state)
      console.error('OAuth state expired')
      return null
    }

    // One-time use - delete after verification
    this.stateCache.delete(state)

    return cached
  }
}

// Usage in MCP OAuth flow
const authManager = new MCPAuthStateManager(process.env.OAUTH_STATE_SECRET)

// When tool requires OAuth
app.get('/mcp/:serverId/tools/:toolName/oauth/authorize', async (req, res) => {
  const { serverId, toolName } = req.params
  const sessionId = req.headers['x-mcp-session'] as string

  const state = authManager.generateState({
    sessionId,
    toolName,
    requestId: crypto.randomUUID(),
    redirectUri: `${req.protocol}://${req.get('host')}/mcp/oauth/callback`,
    expiresAt: Date.now() + 300000
  })

  const authUrl = new URL(oauthConfig.authorizationEndpoint)
  authUrl.searchParams.set('response_type', 'code')
  authUrl.searchParams.set('client_id', oauthConfig.clientId)
  authUrl.searchParams.set('redirect_uri', oauthConfig.redirectUri)
  authUrl.searchParams.set('state', state)
  authUrl.searchParams.set('scope', oauthConfig.scopes.join(' '))

  res.redirect(authUrl.toString())
})

import { z } from 'zod'

// Define strict schemas for MCP tool arguments
const ToolSchemas = {
  read_file: z.object({
    path: z.string()
      .refine(p => !p.includes('..'), 'Path traversal detected')
      .refine(p => !p.startsWith('/etc'), 'System directory access denied')
      .refine(p => !p.startsWith('/root'), 'Root directory access denied')
      .refine(p => !p.includes('.env'), 'Environment file access denied')
  }),

  execute_query: z.object({
    query: z.string()
      .refine(q => !/;s*DROP/i.test(q), 'DROP statement not allowed')
      .refine(q => !/;s*DELETE/i.test(q), 'DELETE requires approval')
      .refine(q => !/;s*TRUNCATE/i.test(q), 'TRUNCATE not allowed'),
    database: z.string().regex(/^[a-zA-Z0-9_]+$/, 'Invalid database name')
  }),

  run_command: z.object({
    command: z.string()
      .refine(c => !c.includes('rm -rf'), 'Recursive delete blocked')
      .refine(c => !c.includes('sudo'), 'Elevated privileges not allowed')
      .refine(c => !c.includes('chmod 777'), 'Insecure permissions blocked')
      .refine(c => !/>s*//.test(c), 'Root filesystem write blocked'),
    timeout: z.number().max(30000).optional()  // 30s max
  }),

  http_request: z.object({
    url: z.string().url()
      .refine(u => !u.includes('localhost'), 'Localhost requests blocked')
      .refine(u => !u.includes('127.0.0.1'), 'Loopback requests blocked')
      .refine(u => !u.includes('169.254'), 'Metadata service access blocked')
      .refine(u => !u.includes('internal'), 'Internal network access blocked'),
    method: z.enum(['GET', 'POST', 'PUT', 'DELETE']),
    headers: z.record(z.string()).optional()
      .refine(h => !h?.Authorization?.includes('Bearer'), 'Auth header injection detected')
  })
}

class MCPInputValidator {
  validate(toolName: string, args: Record<string, unknown>): ValidationResult {
    const schema = ToolSchemas[toolName as keyof typeof ToolSchemas]
    if (!schema) {
      // Unknown tool - require explicit approval
      return { valid: false, reason: 'Unknown tool', action: 'require_approval' }
    }

    try {
      schema.parse(args)
      return { valid: true, action: 'allow' }
    } catch (error) {
      if (error instanceof z.ZodError) {
        const issues = error.issues.map(i => i.message)
        return {
          valid: false,
          reason: `Validation failed: ${issues.join(', ')}`,
          action: 'deny',
          shouldAlert: issues.some(i =>
            i.includes('traversal') ||
            i.includes('injection') ||
            i.includes('blocked')
          )
        }
      }
      return { valid: false, reason: 'Unknown validation error', action: 'deny' }
    }
  }
}

policies:
  # Allow read operations on filesystem tools
  - name: "Allow file reads"
    match:
      tool: "read_file"
      arguments:
        path: "^(?!/etc|/root|/home).*$"  # Exclude sensitive paths
    action: allow

  # Require approval for database writes
  - name: "Approve database writes"
    match:
      tool: "execute_query"
      arguments:
        query: "^(INSERT|UPDATE|DELETE).*$"
    action: require_approval
    approval:
      timeout_minutes: 30
      channels: [slack, email]

  # Block destructive operations entirely
  - name: "Block destructive commands"
    match:
      tool: "run_command"
      arguments:
        command: "^(rm -rf|DROP|truncate).*$"
    action: deny
    response:
      error: "Destructive operations are not permitted"

  # Rate limit API calls
  - name: "Rate limit external APIs"
    match:
      tool: "http_request"
    action: allow
    rate_limit:
      max_calls: 100
      window_seconds: 60