Security¶
Public By Design¶
The application does not implement authentication. Its current purpose is to publish read-only guidance, so everything exposed through the server must be safe to make public.
This includes:
- the website under
/docs/ - resources and prompts under
/mcp - the four read-only fallback tools
Do not add secrets, private notes, credentials, or sensitive environment details to the authored content.
Remote Deployment¶
Place the service behind a reverse proxy or tunnel rather than exposing the container directly. The edge can provide TLS, rate limiting, access logs, and optional authentication without adding those concerns to this small application.
A simple deployment is:
The website and MCP endpoint can remain public while they contain only public, read-only content. Use edge authentication if access should be limited.
When Authentication Becomes Required¶
Protect /mcp before adding any capability that can:
- read non-public files
- access private data or credentials
- call authenticated services
- mutate data
- run commands
- perform expensive work
At that point, choose authentication based on the clients that need to connect. Edge authentication is the simplest option for a small trusted audience; standards-based MCP authorization is more appropriate when broad client interoperability is required.