Security
How sremcp keeps the agent read-only, protects credentials, isolates organizations and records everything.
The agent's reach
- Approved tools only. The agent can only call tools an SRE or admin approved. Tools start pending, and go back to pending when a server changes their definition.
- Role grants. The agent only gets tools from servers the asker's role may use. Report output is only shown to people whose role may use every server the report drew on.
- Read-only by intent. The agent is told never to change anything and to describe remediation for a human instead. The hard boundary is your approvals and credentials, so approve read tools and use read-only credentials.
- Tool output is untrusted. The agent is told to treat what tools return as data, never as instructions. The console never loads images from answers and never renders HTML from them, and opens links only after showing you the address.
Credentials
- MCP server secrets are encrypted with AES-256-GCM, with a key per organization, bound to the server. They can be rotated, never read back, and go only to their own server, never to the AI model.
- OAuth tokens are encrypted the same way, refreshed under a lock so two runs never use a refresh token twice, and cleared when the provider revokes them.
- OAuth sign-ins use PKCE and expire after 10 minutes. Only the person who clicked Connect can finish one.
Outbound calls
sremcp only calls https URLs on public addresses, checked when you save a server and again on every connection. Private networks, loopback, link-local and cloud metadata addresses are refused. Self-hosted deployments can allow private networks, but never metadata addresses. See Expose a self-hosted server.
Organizations
Every request is checked against the caller's membership and role, on the API, for every call. Someone outside an organization can't tell it exists.
Records
Every change and every agent tool call is in the Audit log. Every answer is in Runs.