Skip to main content
MCP connects model-selected tool calls to external authority. Secure the host, transport, OAuth grant, Gateway policy, tool arguments, outputs, approvals, and readback independently; no prompt instruction substitutes for those controls.

​
Threat model

​
Contract tests

Assert:
  • Exactly 12 published tool definitions
  • Stable aura_* names
  • JSON Schema draft 2020-12 metadata
  • Required annotations on every tool
  • Read-only and destructive hints match the operation
  • Required OAuth scope matches the Gateway route
  • Idempotency mode is preserved
  • MCP_SERVER_VERSION is not used as the protocol revision

​
Runtime tests

  1. Register every contract with the host’s schema adapter.
  2. Call one safe read with the correct scope.
  3. Call the same read with a wrong-scope token.
  4. Send a mutating tool with a stable idempotency key.
  5. Replay the same logical mutation with the same key.
  6. Change the payload under that key and expect a conflict.
  7. Confirm destructive annotations reach the host UI.
  8. Confirm the host does not log the delegated token.

​
Transport and OAuth tests

  1. Require HTTPS and reject invalid Origin values at the remote server.
  2. Discover OAuth through Protected Resource Metadata.
  3. Verify PKCE, state, exact redirect URI, token audience, expiry, and revocation.
  4. Reject Fabric keys, provider tokens, and tokens issued for another resource.
  5. Confirm the server never passes the MCP token through to a downstream provider.
  6. If the server returns MCP-Session-Id, reject missing, foreign, fixed, or expired session identifiers and reinitialize after 404.
  7. Resume only the originating SSE stream with Last-Event-ID; never replay messages from another stream.
  8. Bound sessions, reconnects, concurrent calls, output bytes, and total turn time.

​
Prompt-injection tests

Put adversarial instructions inside a returned skill, memory result, trace, and capability description. The host must treat them as data, keep the original tool/purpose boundary, and require approval for any newly proposed mutation.

​
Observability without secret leakage

Record host request ID, MCP request ID, tool name, input digest, approval state, Gateway request/run ID, latency, result type, error code, retry count, and redacted byte count. Never record authorization headers, provider credentials, webhook secrets, raw customer content, or unbounded model output.
The contracts package contains no execution engine. A successful import or host registration does not prove that an Integration Gateway is deployed.
Use the production checklist before enabling the integration for customer data.
Last modified on August 14, 2026