mcp-security-agent/SECURITY.md

An MCP-based security scanner and agentic AI for vulnerability detection

# Security Policy

## Supported Versions

We release patches to fix security vulnerabilities. Which versions are eligible for receiving such patches depends on the CVSS v3.0 Rating:

| Version | Supported          |
| ------- | ------------------ |
| 0.1.x   | :white_check_mark: |
| < 0.1.0 | :x:                |

## Reporting a Vulnerability

We take the security of MCP Security Agent seriously. If you believe you have found a security vulnerability, please report it to us as described below.

**Please do not report security vulnerabilities through public GitHub issues.**

Instead, please report them via email to jross3511@yahoo.com.

You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:

- Type of issue (buffer overflow, SQL injection, cross-site scripting, etc.)
- Full paths of source file(s) related to the vulnerability
- The location of the affected source code (tag/branch/commit or direct URL)
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit it

This information will help us triage your report more quickly.

## Preferred Languages

We prefer all communications to be in English.

## Policy

MCP Security Agent follows the principle of [Responsible Disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure).

## Security Best Practices

When using MCP Security Agent, please follow these security best practices:

1. **Keep Dependencies Updated**: Regularly update all dependencies to patch known vulnerabilities
2. **Use Environment Variables**: Never hardcode secrets, API keys, or sensitive configuration
3. **Review Scan Results**: Always review security scan results and address high-priority findings
4. **Implement Security Policies**: Use the built-in policy engine to enforce security rules
5. **Monitor Audit Logs**: Regularly review audit logs for suspicious activity
6. **Secure Configuration**: Use secure defaults and validate all configuration
7. **Network Security**: Ensure the agent runs in a secure network environment
8. **Access Control**: Implement proper access controls and authentication

## Security Features

MCP Security Agent includes several security features to protect your data:

- **Data Redaction**: Automatically redacts sensitive information before processing
- **Tokenization**: Replaces sensitive data with tokens for AI analysis
- **Audit Logging**: Comprehensive audit trail of all operations
- **Privacy Controls**: Configurable data handling policies
- **Secure Communication**: Uses MCP protocol for secure tool interactions
- **Policy Enforcement**: Built-in security policy engine

## Responsible Disclosure Timeline

- **Day 0**: Security issue is reported
- **Day 1**: Issue is acknowledged and triaged
- **Day 7**: Initial assessment and timeline provided
- **Day 30**: Status update and estimated fix timeline
- **Day 60**: Security patch released (or update on timeline)

## Security Contacts

- **Security Team**: security@mcp-security-agent.org
- **PGP Key**: [Security PGP Key](https://mcp-security-agent.org/security.asc)
- **Bug Bounty**: Currently not offering monetary rewards

## Acknowledgments

We would like to thank the security researchers and community members who have responsibly disclosed vulnerabilities to us. Their contributions help make MCP Security Agent more secure for everyone.