Remote-MCP: threat model, trust boundaries, and service-per-boundary decomposition #956

New Issue

2026-07-28T02:50:41-05:00

jcwalker3 commented

2026-07-28 02:50:41 -05:00

Parent epic: #929.
Cross-link: #955 (certification umbrella).
Depends on: #930 (closed).
Blocks: #932, #933, #934, #938.

Goal supported: secure isolation.

Problem / threat

#930 inventoried stdio coupling, not trust boundaries. No document states what the adversary is, what each boundary protects, or why one process may hold credentials for several services. The current fleet is one codebase authenticating to Gitea while the same control plane reaches Jenkins, GlitchTip/Sentry, and a database — a compromise of one integration reaches credentials for the others.

Current evidence

docs/remote-mcp/coupling-inventory.md (#930) classifies portability, never trust.
#929's completion gate presumes a single endpoint serving five roles without stating whether unrelated integrations may share it.
#75 (closed) bundled Jenkins and GlitchTip into one control-plane umbrella.

Scope

Produce docs/remote-mcp/threat-model.md covering:

Assets.
Adversaries: compromised LLM client, prompt injection, malicious tool arguments, network attacker, curious operator.
Trust boundaries.
Data flows.
Per-boundary credential inventory.
A decomposition decision recording which services may and may not share a process.

Non-goals

Implementation.
Choosing the deployed secret store.
Changing the role taxonomy.

Security and concurrency boundaries

This issue defines them; it changes no code.

Acceptance criteria

Every credential in the system is listed with its holder, boundary, and blast radius.
Every boundary states what it protects and what crossing it requires.
An explicit ruling on whether Gitea, Jenkins, observability, and database credentials may co-reside, with rationale.
Each #929 child from 2 through 10 is mapped to the boundary it implements.
A documented decision that a single integration process must not hold credentials for unrelated services, or an explicit justified exception.

Required positive tests

Documentation review.
Every boundary claim traceable to a file and line anchor that resolves at the reviewed commit.

Required negative and adversarial tests

A written walkthrough of a fully compromised LLM client showing exactly what it reaches at each boundary, before and after the migration.

Deployment, rollback, and observability requirements

None — documentation only.

Definition of done

Committed, reviewed, and referenced by #932, #933, #934, and #938.

Parent epic: #929. Cross-link: #955 (certification umbrella). Depends on: #930 (closed). Blocks: #932, #933, #934, #938. **Goal supported:** secure isolation. ## Problem / threat #930 inventoried **stdio coupling**, not **trust boundaries**. No document states what the adversary is, what each boundary protects, or why one process may hold credentials for several services. The current fleet is one codebase authenticating to Gitea while the same control plane reaches Jenkins, GlitchTip/Sentry, and a database — a compromise of one integration reaches credentials for the others. ## Current evidence - `docs/remote-mcp/coupling-inventory.md` (#930) classifies portability, never trust. - #929's completion gate presumes a single endpoint serving five roles without stating whether unrelated integrations may share it. - #75 (closed) bundled Jenkins and GlitchTip into one control-plane umbrella. ## Scope Produce `docs/remote-mcp/threat-model.md` covering: - Assets. - Adversaries: compromised LLM client, prompt injection, malicious tool arguments, network attacker, curious operator. - Trust boundaries. - Data flows. - Per-boundary credential inventory. - A decomposition decision recording which services may and may not share a process. ## Non-goals - Implementation. - Choosing the deployed secret store. - Changing the role taxonomy. ## Security and concurrency boundaries This issue defines them; it changes no code. ## Acceptance criteria - Every credential in the system is listed with its holder, boundary, and blast radius. - Every boundary states what it protects and what crossing it requires. - An explicit ruling on whether Gitea, Jenkins, observability, and database credentials may co-reside, with rationale. - Each #929 child from 2 through 10 is mapped to the boundary it implements. - A documented decision that a single integration process must not hold credentials for unrelated services, or an explicit justified exception. ## Required positive tests - Documentation review. - Every boundary claim traceable to a file and line anchor that resolves at the reviewed commit. ## Required negative and adversarial tests - A written walkthrough of a fully compromised LLM client showing exactly what it reaches at each boundary, before and after the migration. ## Deployment, rollback, and observability requirements None — documentation only. ## Definition of done Committed, reviewed, and referenced by #932, #933, #934, and #938.

jcwalker3 added the mcp security documentation architecture design type:feature status:ready control-plane labels 2026-07-28 02:50:41 -05:00

jcwalker3 referenced this issue

2026-07-28 02:52:04 -05:00

Remote-MCP: deny-by-default server-side authorization over the full request tuple, read-only by default #957

jcwalker3 referenced this issue

2026-07-28 02:52:49 -05:00

Remote-MCP: host hardening and reproducible service packaging #958

jcwalker3 referenced this issue

2026-07-28 03:06:31 -05:00

Epic: Migrate the Gitea MCP fleet from local stdio processes to a remote MCP deployment #929

jcwalker3 referenced this issue

2026-07-28 03:07:51 -05:00

Epic: certify safe multi-LLM execution through securely isolated remote MCP #955

jcwalker3 added status:in-progress and removed status:ready labels 2026-07-28 03:16:52 -05:00

jcwalker3 commented

2026-07-28 03:16:53 -05:00

Issue claim heartbeat

kind: claim
issue: Remote-MCP: threat model, trust boundaries, and service-per-boundary decomposition (#956)
branch: docs/issue-956-remote-mcp-threat-model
phase: claimed
profile: prgs-author
pr: none
blocker: none
next_action: create worktree and begin implementation

**Issue claim heartbeat** - kind: claim - issue: #956 - branch: docs/issue-956-remote-mcp-threat-model - phase: claimed - profile: prgs-author - pr: none - blocker: none - next_action: create worktree and begin implementation

jcwalker3 referenced this issue from a commit

2026-07-28 03:41:39 -05:00

docs(remote-mcp): threat model, trust boundaries, and decomposition ruling (Closes #956)

jcwalker3 referenced a pull request that will close this issue

2026-07-28 03:43:36 -05:00

docs(remote-mcp): threat model, trust boundaries, and decomposition ruling (Closes #956) #965

jcwalker3 added status:pr-open and removed status:in-progress labels 2026-07-28 03:43:38 -05:00

sysadmin referenced this issue

2026-07-28 04:02:53 -05:00

docs(remote-mcp): threat model, trust boundaries, and decomposition ruling (Closes #956) #965

sysadmin referenced this issue

2026-07-28 04:24:41 -05:00