Security model
DataPorch
Concepts

Security model

Credentials stay local while agents get a narrow, authenticated data interface.

What the agent can see

An MCP client can receive:

  • configured source IDs and capability families;
  • schemas, tables, columns, descriptions, and constraints exposed by discovery;
  • rows returned by an explicitly bounded query.

It does not receive the imported connection string, password, master key, encrypted store contents, or the local admin socket.

Runtime controls

ControlBehavior
Loopback defaultHTTP binds to 127.0.0.1:8080.
MCP authenticationDirect HTTP /mcp requests require a bearer token; local stdio requests use an owner-only runtime credential over a Unix socket.
Admin isolationSource imports and token lifecycle use a Unix socket, not MCP.
Secret storageConnection secrets are encrypted; direct HTTP token storage keeps a SHA-256 verifier, while the local runtime credential is owner-only and exists only for the runtime lifetime.
Read-only executionPostgreSQL and MySQL use read-only transactions; SQLite enables query-only and defensive policies.
Bounded workQuery timeout, row limit, and response-byte budget are enforced server-side.
Origin protectionThe MCP Streamable HTTP handler validates cross-origin requests.

Threat-model boundaries

Read-only SQL does not make a database harmless. Database permissions still matter, and a query can consume resources or expose sensitive rows that the database user can read. Use a least-privilege database account, keep the service local unless a secure remote boundary is designed, and treat both direct HTTP tokens and local runtime credentials as secrets.

DataPorch is not OAuth. Bundled plugins use the local stdio adapter and runtime credential; direct HTTP clients may use a local bearer token. Neither path provides a static credential or OAuth fallback, and cleartext remote bearer transport is unsupported.

Operational habits

  • Keep .dataporch/ and all state paths outside version control.
  • Never put a connection string or token in an MCP prompt, issue, log, or client configuration committed to Git.
  • Rotate a direct HTTP token when it may have been exposed; revoke it when the client should lose access. Local runtime credentials are regenerated on runtime restart.
  • Use source IDs that do not encode credentials or sensitive infrastructure details.