MCP Security Assessment, Server Hardening, and OAuth 2.1 Implementation Services

// Hash reviewed metadata before releasing it to the model.
// The signed registry supplies approvedSha256; never trust a server-supplied hash.
import { createHash, timingSafeEqual } from 'node:crypto';

function canonicalize(value) {
  if (Array.isArray(value)) return value.map(canonicalize);
  if (value && typeof value === 'object') {
    return Object.fromEntries(Object.keys(value).sort().map(key =>
      [key, canonicalize(value[key])]));
  }
  return value;
}

export function verifyToolPin(serverIdentity, tool, approvedSha256) {
  if (!/^[a-f0-9]{64}$/i.test(approvedSha256)) throw new Error('Missing approved pin');
  const metadata = { serverIdentity, tool };
  const actual = createHash('sha256')
    .update(JSON.stringify(canonicalize(metadata)), 'utf8').digest();
  const expected = Buffer.from(approvedSha256, 'hex');
  if (!timingSafeEqual(actual, expected)) throw new Error('Unapproved tool mutation');
  return true;
}
// Pin name, descriptions, schemas, annotations, and server identity together.
// Hash agreement proves unchanged metadata, not that the tool is trustworthy.
// New metadata receives review and a newly signed lockfile before deployment.

# Deployment policy for the workload identity broker, not native Vault syntax.
nhi_workload_policy:
  agent_spiffe_id: spiffe://enterprise.internal/ns/ai-agents/sa/finops-reconciler
  require_workload_attestation: true
  credential_lifetime_seconds: 900
  human_accountability_owner: elango@enterprise.internal
  allowed_downstream_resources:
    - resource: snowflake://prod_gl_warehouse/read_only_views
      action: SELECT
  issuance_policy:
    require_matching_workload_identity: true
    reject_unknown_audience: true
    prevent_scope_escalation: true
  automatic_kill_switch:
    max_queries_per_minute: 50
    deny_new_credentials: true
    revoke_revocable_leases: true
    block_gateway_access: true
# Self-contained JWTs expire on their TTL unless resource servers check revocation.

# Deployment policy translated to runtime and egress-gateway configuration.
# Firecracker microVMs and gVisor container sandboxes are separate runtimes.
mcp_sandbox_policy:
  runtime: gvisor
  run_as_non_root: true
  read_only_root_filesystem: true
  linux_capabilities: []
  host_filesystem_mounts: []
  network:
    default_egress: deny
    allow_https_hosts:
      - company.my.salesforce.com
      - organization-account.snowflakecomputing.com
    deny_cidrs:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 127.0.0.0/8
      - 169.254.0.0/16
      - "::1/128"
      - "fc00::/7"
      - "fe80::/10"
    validate_dns_and_destination_ip: true
    revalidate_each_redirect: true
    deny_cloud_metadata_endpoints: true
# 169.254.169.254 is link-local, outside RFC 1918 private ranges.
# Approved private APIs require explicit egress exceptions and separate tests.