Security model
Credentials stay local while agents get a narrow, authenticated data interface.
What the agent can see
An MCP client can receive:
- configured source IDs and capability families;
- schemas, tables, columns, descriptions, and constraints exposed by discovery;
- rows returned by an explicitly bounded query.
It does not receive the imported connection string, password, master key, encrypted store contents, or the local admin socket.
Runtime controls
| Control | Behavior |
|---|---|
| Loopback default | HTTP binds to 127.0.0.1:8080. |
| MCP authentication | Direct HTTP /mcp requests require a bearer token; local stdio requests use an owner-only runtime credential over a Unix socket. |
| Admin isolation | Source imports and token lifecycle use a Unix socket, not MCP. |
| Secret storage | Connection secrets are encrypted; direct HTTP token storage keeps a SHA-256 verifier, while the local runtime credential is owner-only and exists only for the runtime lifetime. |
| Read-only execution | PostgreSQL and MySQL use read-only transactions; SQLite enables query-only and defensive policies. |
| Bounded work | Query timeout, row limit, and response-byte budget are enforced server-side. |
| Origin protection | The MCP Streamable HTTP handler validates cross-origin requests. |
Threat-model boundaries
Read-only SQL does not make a database harmless. Database permissions still matter, and a query can consume resources or expose sensitive rows that the database user can read. Use a least-privilege database account, keep the service local unless a secure remote boundary is designed, and treat both direct HTTP tokens and local runtime credentials as secrets.
DataPorch is not OAuth. Bundled plugins use the local stdio adapter and runtime credential; direct HTTP clients may use a local bearer token. Neither path provides a static credential or OAuth fallback, and cleartext remote bearer transport is unsupported.
Operational habits
- Keep
.dataporch/and all state paths outside version control. - Never put a connection string or token in an MCP prompt, issue, log, or client configuration committed to Git.
- Rotate a direct HTTP token when it may have been exposed; revoke it when the client should lose access. Local runtime credentials are regenerated on runtime restart.
- Use source IDs that do not encode credentials or sensitive infrastructure details.