MCP security and resilience | ATX AnalyticsTable Docs

MCP security and resilienceHow tools are classified and refused, the SQL guard, secrets in the vault, process isolation, egress rules, the machine policy switches, and the circuit breakers, bulkheads and deadlines that keep a failing server from taking the application down. Every tool a server offers is classified as read, SQL or write, from its name, its arguments and the server's own hints. On a READ-ONLY server, which is the default, write tools (create, update, delete, transition, add comment, …) are refused. SQL arguments must be ONE SELECT or WITH statement, checked before anything is sent. An allow-list and a name pattern can narrow a server further. A local server process gets only its own variables and secrets, never the application's environment or API token, and it is stopped with its whole process tree.

How MCP tools are kept safe

Every tool a server offers is classified as read, SQL or write, from its name, its arguments and the server's own hints. On a READ-ONLY server, which is the default, write tools (create, update, delete, transition, add comment, …) are refused. SQL arguments must be ONE SELECT or WITH statement, checked before anything is sent. An allow-list and a name pattern can narrow a server further. A local server process gets only its own variables and secrets, never the application's environment or API token, and it is stopped with its whole process tree.
A remote server is reached through the installation's proxy and egress guard, and an intranet address needs "Allow private network". Each call has a time limit (30 seconds unless set), each server has a limit on simultaneous calls, and after five consecutive failures a server is PAUSED for 30 seconds. Calls then fail at once instead of hanging, and Reset closes the pause after the cause is fixed. Every call is recorded in the audit trail with a fingerprint of its arguments, never the arguments themselves.

Security model

Every rule below is enforced in the backend at the moment of the call, whoever is calling — a script, Ask Greg or the Settings screen. The screen only shows the result.
Administrators configure — Adding, changing, testing, resetting and deleting a server need the admin role: a local server is a command line this machine runs, and a remote server is a place it sends data. Calling a tool needs analyst; listing needs viewer.
Secrets in the vault — Passwords and Authorization headers named under Secret names are sealed in the same encrypted vault as connection passwords. They are never in the server list file, never returned over HTTP, never logged and never in the audit trail; server output and error text are redacted. A header that looks like a credential but is not marked secret is refused.
Process isolation — A local server gets an allow-listed environment (PATH, temp folders, proxy, CA bundle) plus its own variables — not the backend's environment. It never sees the installation token. NODE_OPTIONS and ANALYTICS_*KEY cannot be set. The process and its children are ended when the server stops.
Read-only by default — Each tool is classed read, SQL or write from its name (create, update, delete, add, transition…), its argument schema and its destructive hint. A read-only hint is believed only when the name agrees, because the MCP specification treats hints as untrusted. On a read-only server, write tools are refused. An execute or run tool whose SQL argument is not named is treated as a write.
SQL guard — For a SQL tool, the arguments named under SQL arguments must hold exactly one SELECT or WITH statement. Side-effect functions (pg_read_file, dblink, xp_* and the like) are refused before anything is sent.
Allow-list and pattern — Allowed tools and Tool name pattern narrow what a server offers — for example only the Jira tools of the Atlassian server.
Egress — Remote servers go through the installation's egress guard and proxy. Private and intranet addresses need Allow private network; plain http is accepted only for loopback or with that switch. A URL may not carry a user name and password.
Audit — Changes are recorded as mcp.server.create, update, delete, test and reset; every call as mcp.tool.call with server, tool, outcome, duration, caller, the route it came by (api, agent or settings) and a SHA-256 hash of the arguments. Arguments and results themselves are never recorded.
Licence read-only mode — Testing a server and calling a tool count as reads; saving a server is a write.
Verified against a real BigQuery project: DELETE, DROP, UPDATE, CREATE TABLE … AS and a SELECT followed by a DELETE were each refused in under two seconds with 422 read_only_sql, and the row count afterwards was unchanged — the statements never reached Google.

Machine policy

These switches are set on the machine (environment or config.ini). They can only narrow what the Settings screen allows.
ANALYTICS_MCP=0 — MCP is off. The screen says so; every MCP route answers 503 disabled.
ANALYTICS_MCP_STDIO=0 — Remote servers only — no local processes. The usual choice for a shared server.
ANALYTICS_MCP_ALLOWED_COMMANDS=npx,uvx,toolbox — Only these executables may be started.
ANALYTICS_MCP_MAX_RESULT_KB — The largest tool result kept (default 256). Longer text is cut and marked truncated.
ANALYTICS_MCP_SERVERS_FILE — Servers delivered by policy. They appear as managed and cannot be changed in the application.

Resilience

Deadline per call — 30 s (per template; at most 300 s) — The call is cancelled and the server is told so
Connect deadline — 60 s — Long enough for a first npx -y download
Circuit breaker — 5 failures in a row → paused 30 s → one trial call — A dead dependency costs one fast 503 unavailable with Retry-After, not a full timeout per call. A caller's own mistakes — refused SQL, bad arguments, a tool that reports an error — do not count.
Bulkhead — 4 calls at once per server, 16 waiting — Further calls get 503 at once, so one slow server cannot hold every request
Reconnect — Once, for safe work — A crashed process or expired session is reconnected without a fuss for listing and read tools. A write is never sent twice.
Tool list cache — 5 minutes — ?refresh=true reads it again
Idle shutdown — 10 minutes — Unused local servers are stopped
Result cap — 256 KB — Longer text is cut and flagged truncated
Health is reported by GET /api/mcp/status, by GET /api/v1/health and on /metrics as analytics_mcp_calls_total{server,outcome}, analytics_mcp_call_duration_seconds, analytics_mcp_circuit_open and analytics_mcp_calls_in_flight. Reset (administrators) closes a circuit and reconnects once the configuration is fixed.

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.