MCP security model

The MCP server treats the model as untrusted. Every tool is designed so the model can plan and act with secrets without ever receiving the raw bytes.

What the model sees

Surface	Content
`list_items`	Item metadata (IDs, labels, storage modes, crypto/content versions, profile IDs, timestamps). No `kind`, tags, or field values — those live in the encrypted payload.
`use_secret`	Exit code, duration, output-line count, truncation flag (no stdout/stderr text)
`mount_secret`	Opaque `mountId`, permissions string, expiry window
`release_mount`	Confirmation of release
`get_audit`	Audit metadata (no secrets)

What the model does not see

Raw plaintext secret values
Any stdout / stderr text from subprocesses spawned by use_secret
The filesystem path of mounted secrets
Decrypted zero-knowledge payloads
Bearer session tokens, private keys, or any auth material
The host’s real environment variables

Enforcement

Guarantee	How
Secrets never in model context	`list_items` returns metadata only; `use_secret` returns no subprocess output text; `mount_secret` returns an opaque ID
No subprocess output forwarded	`use_secret` captures stdout/stderr internally (bounded to 8 KB per stream) but returns only the line count and a truncation flag to the model
Opaque mount IDs	File paths are never returned; mount IDs are random hex tokens
Restricted file permissions	Mounted files use mode `0600` inside a `0700` temp directory
Auto-cleanup	Mounted files are deleted after 5 minutes; orphaned directories are swept on startup
No raw-secret tool	No tool returns raw secret bytes to the model

Why no subprocess output

Earlier designs returned redacted subprocess output to the model. Redaction was best-effort string matching on the literal secret bytes and could not catch transformed forms — base64-encoded output, URL-encoded output, JSON-escaped output, output split across chunks. Any of those vectors leaked the secret to the model. The current design drops subprocess output entirely. If the agent needs to inspect output, route it through a separate audited channel (write to a file via mount_secret, then read it explicitly via a tool the model is allowed to call). This collapses the redaction-bypass surface to zero.

Zero-knowledge items

For zero-knowledge items, the MCP server still relies on the local daemon for decrypt operations. The MCP server itself never holds the profile root key — it asks the daemon to decrypt and inject. This means the MCP server’s trust tier matches the daemon’s (Tier 1). A compromised MCP server can ask the daemon to decrypt items it has permissions for, but it can’t extract the root key or decrypt items it lacks permission for.

Error responses

Tool errors are returned as JSON text content with the shape:

{
  "error": "Human-readable message",
  "code": "<domain code>",
  "hint": "<remediation>",
  "meta": { }
}

error is always present. code, hint, and meta are included when the underlying failure is an AbadgeApiError (an error returned by the control-plane API). Non-API failures (daemon unavailable, filesystem errors, unexpected throws) emit { "error": "..." } only. LLM integrators can parse the code field for deterministic branching; hint is a human-remediation string.

Permissions

The MCP server can only access items where the configured agent has an explicit permission. The use capability (with delivery: env or delivery: file) is the typical grant for MCP. See Permissions and capabilities for the full matrix.

Trust boundary summary

The MCP server sits at Tier 1 (local daemon trust) for ZK items and Tier 3 (server trust) for server-managed items. The model itself is outside every trust tier — the MCP server’s job is to keep it that way.

Getting started

Tools

Security

MCP security model

What the model sees

What the model does not see

Enforcement

Why no subprocess output

Zero-knowledge items

Error responses

Permissions

Trust boundary summary

​What the model sees

​What the model does not see

​Enforcement

​Why no subprocess output

​Zero-knowledge items

​Error responses

​Permissions

​Trust boundary summary

​Related

What the model sees

What the model does not see

Enforcement

Why no subprocess output

Zero-knowledge items

Error responses

Permissions

Trust boundary summary

Related