Safety and Security - visubramaniam/vsp360-mcp GitHub Wiki

The server assumes the person who configures it is trusted, but the model using it may not be: text it reads from VSP 360, such as an alert description, could try to steer it. So the server limits what the model can do on its own. SECURITY.md has the full security model and the latest review.

Read-only by default

Only GET operations are allowed, plus six POST operations that only query or validate:

  • analytics query (only with action=query)
  • inventory filter query
  • authorization check
  • user capabilities
  • bulk-registration CSV validation (needs VSP360_UPLOAD_DIR; see below)
  • upgrade version validation

Everything else is refused before any request is sent, and gets no direct tool. That includes device registration and deletion, the directory connection test (since 0.1.22, because it makes VSP 360 connect to whatever LDAP host it's given), orchestration workflows, user and group changes, certificates, upgrades and notifications. VSP360_ALLOW_WRITES=true allows them. DELETE tools are marked as destructive, so clients like Claude ask for confirmation.

Secrets

  • The three operations that return a live client secret are refused even with writes allowed, unless VSP360_ALLOW_SECRET_READS=true: the read vsp360GetServiceAccountSecret, and the writes vsp360RevealBlockSSOSetup and vsp360RotateBlockSSOSecret (since 0.1.22). Every other operation masks secrets.
  • Credentials are never logged: not in tool output, error messages, the decision log or startup messages.
  • In the Claude Desktop extension, the client secret is marked sensitive.

Local files

Claude chooses file paths, so the server constrains them:

  • Downloads and save_to only write inside VSP360_DOWNLOAD_DIR, never into a hidden folder such as ~/.ssh, and never over an existing file. The folder check resolves symlinks, so a symlink inside the folder can't send a write elsewhere (since 0.1.22). Server-supplied file names are reduced to a bare name, so ../ can't escape.
  • Uploads refuse hidden files and folders, such as ~/.ssh and .env. With VSP360_UPLOAD_DIR set, they must come from inside that folder, even through symlinks.
  • In read-only mode, uploads need VSP360_UPLOAD_DIR. Otherwise the CSV validation operation could be used to send any non-hidden local file to VSP 360. This has been fixed since 0.1.17. On 0.1.16 and earlier, set VSP360_UPLOAD_DIR yourself.

Network

  • TLS certificates are verified by default. Use VSP360_CA_CERT for a private CA rather than VSP360_INSECURE_TLS.
  • VSP360_URL must be https:// unless VSP360_ALLOW_HTTP=true (since 0.1.22).
  • The client secret and token only go to VSP360_URL: the token request never follows a redirect, API requests follow redirects only within VSP360_URL, and pagination links are re-homed to it.
  • Path parameters can't be . or .. or contain / or \, so URL normalisation can't reach a different endpoint.
  • At most VSP360_MAX_RESPONSE_BYTES (64 MiB) of a response, or of all pages of an all_pages call, is read into memory, and max_pages is capped at 200.

Recommendations

  • Use a dedicated service account with only the VSP 360 access you need.
  • Keep the server read-only unless you need changes, and turn writes on only for the sessions that need them.
  • Set VSP360_UPLOAD_DIR to an empty, dedicated folder.
  • Use an https:// URL with TLS verification on.
  • Prefer clients that ask before each tool call when writes are allowed.

Supply chain

  • npm versions published by the Release workflow carry a signed provenance attestation linking them to the commit and workflow run. Check with npm audit signatures.
  • Every GitHub release has a SHA256SUMS file covering all its packages.
  • The container image runs as a non-root user.
  • GitHub Actions are pinned by commit SHA and the base image by digest. The Node.js runtime in the standalone packages is checked against its release's checksums, whose signature is verified with the Node.js release keys. Dependabot opens weekly update pull requests.

Reporting a vulnerability

Use GitHub's private reporting: the repository's Security tab, then Report a vulnerability. Please don't open a public issue.