Security & Trust Center

Security Architecture Overview

AI agents powered by large language models act dynamically, generating tool calls in real-time. This requires a security architecture built on Zero Trust — no agent has ambient access to any system. Every request is authenticated, authorized, and logged before execution.

1. Model Context Protocol (MCP) RBAC Engine

The MakeYourMCP gateway hosts a high-performance policy engine designed specifically for Model Context Protocol interactions. When an agent requests a tool call, the gateway intercepts the call and runs it through our policy evaluator before executing it against the target database or API.

• Fine-Grained Permissions: Permissions are bounded by database, schema, table, and allowed operation type (Read / Write / Modify / Delete).
• Parameter Masking: Protect sensitive database entries by masking columns (such as credit card numbers or PII) dynamically before returning data to the LLM context.
• Approval Gates: Any action classified as critical (e.g. bulk export, schema alteration, or financial transaction) can trigger an asynchronous approval workflow, halting execution until a human administrator authorizes it.
• MCP Threat Coverage: Built-in detection for tool poisoning attacks, rug-pull attempts (tool definitions that change post-registration), and cross-server tool name shadowing.

See connector-specific RBAC configuration guides: PostgreSQL, Snowflake, Slack, GitHub, and Salesforce. Policy rules are defined in the Policy YAML Schema.

2. Credential Vaulting & Isolation

AI agents should never have direct access to your database connection strings, passwords, or API tokens. If an agent is compromised via prompt injection, it could leak those credentials in plain text.

MakeYourMCP keeps all access credentials isolated in a dedicated hardware security module (HSM) credential vault. The agent only invokes tool calls by reference (e.g., query_crm), and the gateway hydrates and authenticates the connection server-side, completely shielding credentials from the LLM prompt context.

3. Comprehensive Audit Logs & SIEM Integration

Compliance and trace validation are central to security governance. MakeYourMCP maintains tamper-evident audit logs of all agent tool transactions.

• Complete Traceability: Every audit entry records the initiating user ID, agent model, requested tool, matched policy rule, duration, database rows accessed, and the final decision.
• Log Retention: Logs are stored in write-once-read-many (WORM) storage. Starter plans retain logs for 7 days, Professional for 30 days, and Enterprise plans offer unlimited retention.
• SIEM Streams: Enterprise customers can stream audit events in real-time via secure webhooks or Syslog formats to tools like Splunk, Datadog, or AWS CloudWatch.

4. Data Residency & Compliance

Continuous Compliance Alignment. We actively design and maintain all system components to align with standard compliance frameworks (including SOC 2 and ISO 27001), ensuring ready audit paths when you deploy inside your environment.

• VPC Deployment: Our gateway can be run self-hosted inside your AWS VPC or Azure VNet, keeping all transaction data within your compliance boundary.
• Encryption: All data in transit is encrypted using TLS 1.3. Data at rest is encrypted using AES-256 with customer-managed keys (CMK) on Enterprise plans.
• GDPR: A Data Processing Agreement (DPA) and sub-processor list are available at /security/dpa.

5. Responsible Disclosure & Incident Response

If you discover a vulnerability in MakeYourMCP, we want to hear from you. We operate a structured responsible disclosure program:

• Contact: Report findings to connect@makeyourmcp.com. PGP-encrypted communication is available on request.
• Triage SLA: All reports are acknowledged within 4 hours and triaged within 24 hours during business days.
• Scope: In-scope targets include the MakeYourMCP gateway API, policy engine, credential vault interfaces, and web application. Out-of-scope: third-party services, social engineering.
• Safe Harbour: We will not pursue legal action against researchers who discover and responsibly disclose vulnerabilities following this policy.
• Disclosure timeline: We aim to resolve critical vulnerabilities within 14 days of confirmed reproduction and will coordinate public disclosure timing with the reporter.

A permanent, linkable disclosure page is available at /disclosure.