We release patches for security vulnerabilities for the following versions:

We take the security of MCP Compression Proxy seriously. If you discover a security vulnerability, please follow these steps:

Please do NOT open a public issue.

Instead:

1. Email: Report vulnerabilities via GitHub's private vulnerability reporting feature, or
2. GitHub Issues: Create a new issue marked with the "security" label and we'll address it privately

When reporting a vulnerability, please include:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Suggested fix (if you have one)
• Your contact information

• Acknowledgment: We aim to acknowledge receipt within 48 hours
• Initial Assessment: We'll provide an initial assessment within 5 business days
• Updates: We'll keep you informed of our progress
• Resolution: We aim to release a fix as soon as possible, depending on complexity

• Please give us reasonable time to fix the issue before public disclosure
• We'll credit you in the security advisory (unless you prefer to remain anonymous)
• We'll coordinate with you on the disclosure timeline

When using MCP Compression Proxy:

1. Keep Updated: Always use the latest version
2. Review Server Configs: Carefully review server configurations before use
3. Trust Sources: Only aggregate tools from trusted MCP servers
4. Environment Variables: Protect any sensitive environment variables (API keys, tokens)
5. File Permissions: Ensure configuration files have appropriate permissions

1. No Secrets in Code: Never commit API keys, passwords, or secrets
2. Environment Variables: Use environment variables for sensitive data
3. Access Control: Configure underlying MCP servers with appropriate access controls
4. Monitor Logs: Review logs for suspicious activity
5. Principle of Least Privilege: Only enable servers you need

• The aggregator connects to multiple MCP servers with their configured permissions
• Each underlying server has its own security model and access controls
• Review the security implications of each aggregated server
• Servers run with the permissions of the user who starts them

• Compressed descriptions are stored in-memory
• Cache is cleared on server restart
• No persistent storage of sensitive data

• Sessions expire after 30 minutes of inactivity
• Session IDs are randomly generated
• Sessions are independent and isolated

• The server runs with the permissions of the user who starts it
• Environment variables are accessible to the server
• Use appropriate security practices for your environment

Security updates will be:

• Released as patch versions (e.g., 0.1.1)
• Documented in CHANGELOG.md
• Announced in the release notes
• Tagged with [SECURITY] in commit messages

For security concerns, please use GitHub's security features or create a private issue.

Thank you for helping keep MCP Compression Proxy secure!