Security model

A generated MCP server is a proxy: it receives tool calls from an MCP client and makes HTTP requests to your API with the credentials you configure. This page explains where the trust boundaries are.

What the generator does for you#

• Credentials stay out of code. Upstream credentials are read from environment variables (or Worker secrets) at runtime. See Authentication.
• Credentials fail closed. If a tool's required credentials are not set, it returns an error naming them instead of calling your API without them.
• Input validation. Tool arguments are validated against JSON Schema 2020-12 schemas generated from your spec before any upstream request is made. Defaults are not injected and the validator never uses eval, so the same code runs on Node and Workers.
• Safe templating. Text from your spec's description and summary fields is escaped before it is written into generated code, so a malicious spec cannot inject code that runs at server startup.
• SSRF protection while parsing. External http(s) $refs inside a spec are rejected by default. Opt in with --allow-external-refs only for specs you trust.
• TLS verification on. Certificate checks stay enabled unless you pass --insecure.
• Built-in bearer auth. --inbound-auth bearer protects the MCP endpoint with a token compared in constant time (see below).
• Browser origin checks. Node HTTP servers reject browser requests from origins that are not loopback or listed in MCP_ALLOWED_ORIGINS, which blocks DNS-rebinding attacks on servers running on your machine.

What you are responsible for#

Inbound authentication#

Generate with --inbound-auth bearer and set MCP_AUTH_TOKEN (.env on Node, npx wrangler secret put MCP_AUTH_TOKEN on Workers):

• Every MCP request must send Authorization: Bearer <token>; others get 401 before any tool runs. /health stays public.
• Tokens are read at runtime, never written into generated files. Rotate with MCP_AUTH_TOKENS=new-token,old-token.
• With no token configured the server fails closed with 503.
• Claude.ai and ChatGPT connectors use OAuth or no auth, so put the server behind an OAuth-capable gateway such as Cloudflare Access for those.

See Deploy to Cloudflare Workers.

Shared identity#

By default every caller acts with the same upstream credentials. If callers should act as themselves, use --header-passthrough (web, streamable-http, cloudflare-worker) so each client sends its own key.

Tool scope#

Every included operation becomes a tool, including writes and deletes. Expose only what you need: use x-mcp: false, --default-include false or the tag and operation filters. Tool annotations mark GET tools read-only and DELETE tools destructive so clients can ask before running them. See Large APIs.

Untrusted specs#

The generator treats your spec as input, but you should still review generated code from specs you did not write.

MCP Cloud#

The hosted option has its own planned controls: isolated Workers, metadata-only logs, encrypted stored secrets and allow-listed outbound hosts. They are described on the Security & trust page and are planned for beta, not live.

Reporting a vulnerability#

Please do not open a public issue for security problems. Follow the process in the repository's security policy.