Security

Layered security controls for incoming client connections and outgoing backend connections in Argus MCP.

Argus MCP provides layered security controls for both incoming client connections and outgoing backend connections.

Security Layers

MCP Client
  |
  v
+----------------------------+
|  1. Incoming Auth          |  Verify client identity (JWT, OIDC, local token)
+----------------------------+
|  2. RBAC Authorization     |  Check role-based policies
+----------------------------+
|  3. Audit Logging          |  Record all operations (NIST SP 800-53)
+----------------------------+
|  4. Secret Redaction       |  Scrub secrets from all log output
+----------------------------+
|  5. Outgoing Auth          |  Authenticate to backends (OAuth2, static)
+----------------------------+
|  6. Container Isolation    |  Hardened per-backend containers (read-only,
|                            |  non-root, cap-drop ALL, resource limits)
+----------------------------+
  |
  v
Backend MCP Server

Documentation

TopicDescription
AuthenticationIncoming client auth (anonymous, local, JWT, OIDC)
AuthorizationRBAC policy enforcement
Secrets ManagementEncrypted secret store and resolution

Security Defaults

FeatureDefaultProduction Recommendation
Incoming authanonymousjwt or oidc
Management API authdisabled (no token)Set ARGUS_MGMT_TOKEN
RBACdisabledEnable with default_effect: deny
Audit loggingenabledKeep enabled
Secret providerfile (Fernet)file or keyring
Log redactionautomaticAutomatic when secrets are resolved
Container isolationauto (when runtime available)Pre-build images; keep enabled