Remote-MCP: host hardening and reproducible service packaging #958

New Issue

2026-07-28T02:52:49-05:00

jcwalker3 commented

2026-07-28 02:52:49 -05:00

Parent epic: #929.
Cross-link: #955 (certification umbrella).
Depends on: #938, #956.

Goal supported: secure isolation.

Problem

#938 stands up an authenticated endpoint but says nothing about what that process may reach on its host. A server holding every role's Gitea credential with an unrestricted filesystem, ambient environment, a privileged service account, and unrestricted egress moves the credential rather than protecting it. Nothing defines how the service is built or verified.

Current evidence

#938's scope covers transport, handshake, principal binding, provider configuration, rate limiting, logging, and docs — no filesystem, service-account, or egress restriction.
No issue mentions packaging, image digests, or reproducibility.

Scope

Run under a dedicated unprivileged service account.
Restrict the filesystem to an explicit allowlist.
Strip the inherited environment to an enumerated set.
Restrict outbound network to the Gitea host and required stores, denying all else.
Package as an immutable, digest-pinned, reproducibly-built artifact with a recorded provenance attestation.
Verify the digest at deploy.

Non-goals

Choosing a cloud provider.
Performance tuning.
Migrating other MCP servers.

Security and concurrency boundaries

This issue defines the host boundary containing the credential-holding process. Nothing inside it may reach a resource outside the allowlist.

Acceptance criteria

The service account holds no interactive login and no privileged group.
A path outside the allowlist fails closed.
An unlisted environment variable is absent at runtime.
Egress to an unapproved host is refused and audited.
Deployment refuses an artifact whose digest does not match.
A rebuild from the same source produces the same digest.

Required positive tests

Full startup and one mutation per role under the restricted profile.

Required negative and adversarial tests

Attempted read of an out-of-allowlist path.
Attempted egress to an arbitrary host.
A tampered artifact refused at deploy.
A subprocess attempting to inherit credential environment.

Deployment and migration requirements

Pinned digests.

Rollback and recovery requirements

The previous digest remains redeployable.

Observability and audit requirements

Refusals are audited with the attempted resource, never the credential.

Definition of done

The endpoint runs only under this profile, and #938 references it as a precondition.

Parent epic: #929. Cross-link: #955 (certification umbrella). Depends on: #938, #956. **Goal supported:** secure isolation. ## Problem #938 stands up an authenticated endpoint but says nothing about what that process may reach on its host. A server holding every role's Gitea credential with an unrestricted filesystem, ambient environment, a privileged service account, and unrestricted egress moves the credential rather than protecting it. Nothing defines how the service is built or verified. ## Current evidence - #938's scope covers transport, handshake, principal binding, provider configuration, rate limiting, logging, and docs — no filesystem, service-account, or egress restriction. - No issue mentions packaging, image digests, or reproducibility. ## Scope - Run under a dedicated unprivileged service account. - Restrict the filesystem to an explicit allowlist. - Strip the inherited environment to an enumerated set. - Restrict outbound network to the Gitea host and required stores, denying all else. - Package as an immutable, digest-pinned, reproducibly-built artifact with a recorded provenance attestation. - Verify the digest at deploy. ## Non-goals - Choosing a cloud provider. - Performance tuning. - Migrating other MCP servers. ## Security and concurrency boundaries This issue defines the host boundary containing the credential-holding process. Nothing inside it may reach a resource outside the allowlist. ## Acceptance criteria - The service account holds no interactive login and no privileged group. - A path outside the allowlist fails closed. - An unlisted environment variable is absent at runtime. - Egress to an unapproved host is refused and audited. - Deployment refuses an artifact whose digest does not match. - A rebuild from the same source produces the same digest. ## Required positive tests - Full startup and one mutation per role under the restricted profile. ## Required negative and adversarial tests - Attempted read of an out-of-allowlist path. - Attempted egress to an arbitrary host. - A tampered artifact refused at deploy. - A subprocess attempting to inherit credential environment. ## Deployment and migration requirements Pinned digests. ## Rollback and recovery requirements The previous digest remains redeployable. ## Observability and audit requirements Refusals are audited with the attempted resource, never the credential. ## Definition of done The endpoint runs only under this profile, and #938 references it as a precondition.