Built like infrastructure.
We host code generated by an LLM, on behalf of customers, that exposes their internal APIs to AI clients. The threat model is real. Here is what we do about it.
Per-server isolation
Every customer MCP server runs in its own Docker container. No shared process, no shared filesystem, no shared memory. One server compromised does not affect any other.
Encrypted secrets
API keys and credentials are AES-256-GCM encrypted at rest in Postgres with a 32-byte key sourced from env. Decryption happens only at the moment of container ENV injection. Plaintext is never logged.
OAuth 2.1, no API keys for end users
Every generated server is an OAuth 2.1 Resource Server. PKCE, Dynamic Client Registration (RFC 7591), Resource Indicators (RFC 8707), RS256-signed JWTs. Short-lived, audience-bound, replay-resistant.
No token passthrough
When a tool calls a downstream API, it uses its own server-side credentials — not the user's OAuth token. Tokens never leak across trust boundaries. This is mandated by the MCP authorization spec.
Static security checks
Every LLM-generated tool body is scanned for banned patterns (eval, new Function, child_process) before Docker build. Prompt-injection markers like "ignore previous instructions" also trip the check. Build fails fast, no risky code ships.
Container hardening
Production containers run with --read-only, --cap-drop=ALL, --security-opt=no-new-privileges, CPU and memory limits. Network egress can be restricted to whitelisted domains per server.
Audit log
Every privileged action — login, logout, server create/iterate/delete — is recorded with IP, timestamp, user, and metadata. Available via /audit for Team-and-above orgs.
Rate limiting
Default 100 requests/min/IP per tool, enforced at the Traefik layer before traffic ever reaches your container. Daily preview + build caps per tier protect against runaway LLM spend.
AI provider by tier — transparent
Hobby (free) tier uses Zhipu's GLM model (servers in China) for prompt analysis — chosen for cost so we can offer a real free tier. Pro, Team and Enterprise use Anthropic Claude (US). Enterprise can request EU-only data residency. The provider is shown live in the wizard so you always know where your prompt is going.
Disclosure
Found a vulnerability? Email [email protected] with a clear reproduction. We respond within 48h. We do not run a paid bounty yet, but we will credit you publicly in the changelog (or anonymously if you prefer).
Key fingerprint published at buildmymcpserver.com/.well-known/security.txtCompliance roadmap
SOC 2 Type I is targeted for Q4 2026. The GDPR posture is described in our privacy policy. If you need a DPA or other contracts ahead of SOC 2, reach out — Team and Enterprise customers get one on request.