MCP connects model-selected tool calls to external authority. Secure the host,
transport, OAuth grant, Gateway policy, tool arguments, outputs, approvals, and
readback independently; no prompt instruction substitutes for those controls.
Threat model
Contract tests
Assert:
- Exactly 12 published tool definitions
- Stable
aura_* names
- JSON Schema draft 2020-12 metadata
- Required annotations on every tool
- Read-only and destructive hints match the operation
- Required OAuth scope matches the Gateway route
- Idempotency mode is preserved
MCP_SERVER_VERSION is not used as the protocol revision
Runtime tests
- Register every contract with the host’s schema adapter.
- Call one safe read with the correct scope.
- Call the same read with a wrong-scope token.
- Send a mutating tool with a stable idempotency key.
- Replay the same logical mutation with the same key.
- Change the payload under that key and expect a conflict.
- Confirm destructive annotations reach the host UI.
- Confirm the host does not log the delegated token.
Transport and OAuth tests
- Require HTTPS and reject invalid
Origin values at the remote server.
- Discover OAuth through Protected Resource Metadata.
- Verify PKCE, state, exact redirect URI, token audience, expiry, and revocation.
- Reject Fabric keys, provider tokens, and tokens issued for another resource.
- Confirm the server never passes the MCP token through to a downstream provider.
- If the server returns
MCP-Session-Id, reject missing, foreign, fixed, or expired session identifiers and reinitialize after 404.
- Resume only the originating SSE stream with
Last-Event-ID; never replay messages from another stream.
- Bound sessions, reconnects, concurrent calls, output bytes, and total turn time.
Prompt-injection tests
Put adversarial instructions inside a returned skill, memory result, trace, and
capability description. The host must treat them as data, keep the original
tool/purpose boundary, and require approval for any newly proposed mutation.
Observability without secret leakage
Record host request ID, MCP request ID, tool name, input digest, approval state,
Gateway request/run ID, latency, result type, error code, retry count, and
redacted byte count. Never record authorization headers, provider credentials,
webhook secrets, raw customer content, or unbounded model output.
The contracts package contains no execution engine. A successful import or
host registration does not prove that an Integration Gateway is deployed.
