Security at a glance
| Area | Implementation |
|---|---|
| Encryption at rest | Google Cloud KMS (AES-256-GCM) for all secrets, credentials, and environment variables |
| Encryption in transit | TLS 1.2+ on all external traffic, Google-managed certificates |
| Container isolation | gVisor kernel-level sandboxing, dedicated Kubernetes namespace, strict network policies |
| Authentication | OAuth 2.0 with PKCE (S256), RS256 JWT tokens, Firebase identity |
| Authorization | Per-request RBAC checks, permission groups, tool-level access control |
| Credential storage | KMS-encrypted, per-user scoped, never exposed in API responses |
| Activity logging | Every tool call logged with full inputs, outputs, latency, and status |
| Audit logging | 50+ event types covering admin actions, credential changes, and access modifications |
| Org isolation | Enforced at every API layer. One org cannot access another’s servers, data, or credentials |
| Secret redaction | Secrets are redacted from runtime logs, error messages, and API responses |
Key principles
Everything is encrypted
All sensitive data is encrypted using Google Cloud KMS before being stored in the database. This includes environment variables, OAuth tokens, API keys, and user credentials. The encryption key is managed in KMS (agenthub-keyring/secrets-values-key) and never leaves Google’s infrastructure.
All external traffic uses TLS 1.2+ with Google-managed certificates. HTTP requests are automatically redirected to HTTPS.
Every server is isolated
Each MCP server runs in its own container with gVisor sandboxing, which intercepts all system calls at the kernel level. Servers are deployed in a dedicated Kubernetes namespace with network policies that block all private IP traffic, preventing lateral movement between servers or access to internal services. Customer code has no cloud credentials. All GCP operations are proxied through the Gumstack backend API.Access is verified on every request
There is no caching of permission checks. Every tool call goes through:- Token validation against the Gumstack backend
- RBAC check against the user’s permission group and tool access matrix
- Activity logging with full request details
Credentials never leave the server
User credentials (OAuth tokens, API keys) are stored encrypted in the database and decrypted only at the point of use within the server. They are never sent to MCP clients, never included in API responses, and never written to logs.Detailed documentation
Infrastructure Security
Hosting, container isolation, network architecture, TLS, build pipeline, and scaling
Data Protection
Encryption, secrets management, credential handling, logging, audit trails, and privacy
Permission Groups
RBAC configuration, tool access control, and group management
Authentication
OAuth, API Key, and No Auth methods for MCP servers