Tenant boundary · Available now
Every management request resolves a tenant on the server; tenant-scoped repositories enforce it again.
Security and trust
Treat every MCP server as a trust boundary.
LiteMCP Composer is designed around least privilege, explicit identity, policy at discovery and execution, credential isolation, request correlation, and portable audit evidence.
Enforcement boundaries
Defense is repeated, not implied.
Identity boundary · Preview
Gateway sessions bind the authenticated subject, organization, composition, environment, expiry, and revocation state. Client hints are not yet a cryptographic binding.
Discovery boundary · Available now
Policy removes capabilities the current principal is not allowed to discover.
Execution boundary · Preview
The gateway re-evaluates policy and approval state before every upstream invocation.
Credential boundary · Planned
The planned broker will issue short-lived execution material without exposing durable provider secrets. Connected accounts and the credential vault are not implemented.
Network boundary · Preview
The Node executor pins validated public addresses and bounds HTTP behavior. Equivalent managed cloud egress proof and isolated stdio execution remain outstanding.
Responsible disclosure
Report privately. Patch publicly.
Use GitHub private vulnerability reporting. Include affected versions, reproduction detail, impact, and a safe contact channel.
- Acknowledgement
- A response target has not yet been contractually published.
- Coordination
- Reports should remain private until a fix and advisory can be coordinated.
- Advisories
- Confirmed issues will use public security advisories and affected-version guidance.
- Certifications
- No certification, audit completion, or compliance attestation is claimed at this stage.
This trust center describes product design intent and current public commitments. It is not a certification report, penetration-test claim, contractual control description, or legal warranty.