Reference Brief / MCP Enterprise Platform

Production deployment of the Model Context Protocol

spec 2025-11-25OAuth 2.1JSON-RPC 2.0 Centralized portal, identity-brokered, audit-centralized, DLP-enforced. Streamable HTTP transport only in production; stdio retired except development.

Components

Architecture path

Transport (Streamable HTTP)

Authorization (OAuth 2.1)

• OAuth 2.1 mandatory for MCP servers as resource servers. Clients implement DCR (RFC 7591) or OAuth Client ID Metadata Documents (SEP-991, added 2025-11-25).
• RFC 9728 (Protected Resource Metadata) mandatory for servers. 401 response carries WWW-Authenticate with resource_metadata URL pointing to /.well-known/oauth-protected-resource; document declares authorization_servers.
• RFC 8707 (Resource Indicators) mandatory for clients. resource parameter on token requests binds the access token to a specific MCP server URL; without it tokens are ambient and leak across resources.
• AS metadata via RFC 8414 at /.well-known/oauth-authorization-server. OpenID Connect Discovery 1.0 also supported (added 2025-11-25).
• Per-tool scopes: mcp:read, mcp:write, mcp:exec. Validate signature, audience (RFC 8707 §2), expiry every call.
• Incremental scope consent via WWW-Authenticate (SEP-835). Client steps up scope mid-session without full re-auth.
• URL Mode Elicitation (2025-11-25): server sends user to external OAuth flow in browser; credentials never transit MCP client. Enables PCI-compliant payment, third-party authorization without token passthrough.
• Token rotation under 24h. Insufficient authentication / authorization is OWASP MCP07; privilege escalation via scope creep is MCP02.

Wire format

Observability

• Per-call audit: caller, tool, params (sensitive fields redacted), outcome, latency, policy decisions (rate limit, deny list, kill switch). Lack of audit and telemetry is OWASP MCP08.
• Real-time ship to SIEM via OpenTelemetry / Vector / fluentd. Append-only on receiver. Cryptographic chaining for high-stakes audit.
• DLP at portal: per-tool rules block PII / PHI / secrets / source-with-keys. Context injection & over-sharing is OWASP MCP10.
• Token-shape regex redaction at log layer; token mismanagement is MCP01. No long-lived tokens in logs.

Multi-tenancy

• Portals are the policy boundary; upstream servers stay group-unaware.
• One upstream MCP behind multiple portals with different scopes, policies, audit streams.
• Cache keys must include tenant identity to prevent cross-tenant leakage.

Code Mode novel

• Code Mode collapses upstream tool catalogs to 2 portal tools: portal_codemode_search, portal_codemode_execute.
• Model writes JS against discovery + execution proxies in sandboxed runtime (Cloudflare Dynamic Workers in their reference implementation).
• Reported: 52 tools / 9,400 tokens to 2 / 600 (94% reduction); cost fixed regardless of MCP count.
• Trade-off: model-written code is itself an injection surface. Command injection & execution is OWASP MCP05.
• Phase 6 optimization. Pilot after base platform stable.

Shadow MCP

• Shadow MCP servers = OWASP MCP09. Unsanctioned servers accessed outside the portal.
• SWG detection: /mcp and /mcp/sse paths, JSON-RPC method strings (tools/call, tools/list, initialize, sampling/createMessage), Mcp-Session-Id header presence.
• DLP regex on body: "method"\s*:\s*"tools/(call|list)"; "protocolVersion"\s*:\s*"202[5-6]-[0-9]{2}-[0-9]{2}".
• Action: block at egress, log to investigation queue.

First-party policy

• Mandate: every internal service exposed via MCP ships a first-party server. No community packages of unknown provenance.
• Vendors publish official MCPs to prevent customer consumption of third-party packages. Supply chain attacks & dependency tampering is OWASP MCP04.
• SBOM scanned every build. Tool poisoning (MCP03) sub-techniques: rug pulls, schema poisoning, tool shadowing.

Threat model: OWASP MCP Top 10 (2025)

Threat-model deltas (local → shared)

Transition phases

1. Inventory existing MCP usage. SWG identifies gaps. visibility
2. Stand up portal; integrate identity (OAuth 2.1 + RFC 9728 + RFC 8707), audit, DLP. platform
3. Migrate low-risk MCP. Validate per-call authz, session lifecycle, SSE resume. first server
4. Migrate high-traffic MCP with full hardening (rate limits, deny lists, response shaping, circuit breaker, cardinality estimation where applicable). operational pattern
5. Block local at policy + network for migrated upstreams. SWG enforces. enforcement
6. Roll out remaining servers. High-risk surfaces (shell exec, code exec, fs-write) sit last. remaining surface
7. Pilot Code Mode. Measure token reduction in production traffic. Default-on if sandbox holds under adversarial input. optimization

Decision points

References