Security

Your credentials

Upstream secrets (headers, query parameters, session tokens) are encrypted with a per-server key, which is itself encrypted with a key held outside the database.
They are write-only: never returned by the API, shown in the dashboard, written to logs or cached.
Upstream sign-in passwords are used once and never stored.
API keys are stored as hashes; the full key is shown only when it's created.

Calls to your API

SourceMCP only calls the base URL you set. Requests to private, loopback and cloud-metadata addresses are blocked, including through redirects and DNS tricks.
The client's API key or OAuth token is never sent to your API.
Calls time out after 30 seconds by default (at most 60), and SourceMCP reads at most 2 MB of a response.
Logs keep metadata only (tool, status, duration) for 7 days. Argument and response previews are off unless you turn them on for a server, and secrets are scrubbed from them.

Prompt injection

An MCP server gives a model the power to act with your credentials. Treat that as you would any other access you grant:

Data your API returns is read by the model. Text in a record (a support ticket, a product review, a file name) can contain instructions aimed at the model. SourceMCP passes responses through unchanged; it can't tell data from instructions, and neither can every model.
Expose the fewest endpoints that do the job, and prefer read-only ones. Turn on write or delete endpoints only when the assistant needs them, and keep your client's approval prompt on for them.
Use credentials with the least access your API offers: a read-only key, a scoped token, or a dedicated service account.
Don't mix untrusted content and powerful tools in one session, for example reading public issues while a delete tool is available.

Your account

You can delete your account from the account page. That removes your servers, tools, API keys, stored credentials and logs.

Report a concern

Email [email protected] if you find a security issue or have a question about how SourceMCP handles your data.

Your credentials

Upstream secrets (headers, query parameters, session tokens) are encrypted with a per-server key, which is itself encrypted with a key held outside the database.

They are write-only: never returned by the API, shown in the dashboard, written to logs or cached.

Upstream sign-in passwords are used once and never stored.

API keys are stored as hashes; the full key is shown only when it's created.

Calls to your API

SourceMCP only calls the base URL you set. Requests to private, loopback and cloud-metadata addresses are blocked, including through redirects and DNS tricks.

The client's API key or OAuth token is never sent to your API.

Calls time out after 30 seconds by default (at most 60), and SourceMCP reads at most 2 MB of a response.

Logs keep metadata only (tool, status, duration) for 7 days. Argument and response previews are off unless you turn them on for a server, and secrets are scrubbed from them.

Prompt injection

An MCP server gives a model the power to act with your credentials. Treat that as you would any other access you grant:

Data your API returns is read by the model. Text in a record (a support ticket, a product review, a file name) can contain instructions aimed at the model. SourceMCP passes responses through unchanged; it can't tell data from instructions, and neither can every model.

Expose the fewest endpoints that do the job, and prefer read-only ones. Turn on write or delete endpoints only when the assistant needs them, and keep your client's approval prompt on for them.

Use credentials with the least access your API offers: a read-only key, a scoped token, or a dedicated service account.

Don't mix untrusted content and powerful tools in one session, for example reading public issues while a delete tool is available.