Security Pipeline - superbox.ai

Overview

SuperBox implements a comprehensive 5-step security pipeline that automatically scans every MCP server before publication to ensure security, quality, and reliability.

Zero-Trust Security Model

Every MCP server undergoes rigorous automated security scanning before deployment.

SonarQube

Code quality & security analysis

Bandit

Python security vulnerability detection

GitGuardian

Secrets and credentials scanning

Semgrep

Static analysis for vulnerabilities

OWASP

Dependency vulnerability checking

Manual Review

Human verification for edge cases

Security Pipeline Architecture

Pipeline Steps

Step 1: SonarQube Analysis

Overview
Configuration
Execution
Results

SonarQube performs comprehensive code quality and security analysis:

Code Smells

Identifies maintainability issues:

Complex functions
Duplicated code
Long parameter lists
Cognitive complexity

Bugs

Detects potential runtime errors:

Null pointer dereferences
Resource leaks
Logic errors
Exception handling issues

Security Hotspots

Highlights security-sensitive code:

SQL injection risks
XSS vulnerabilities
Insecure crypto usage
Authentication bypasses

Code Coverage

Measures test coverage:

Line coverage
Branch coverage
Function coverage
Target: >80% coverage

sonar-project.properties

sonar.projectKey=superbox-mcp-server
sonar.projectName=Weather MCP Server
sonar.projectVersion=1.0.0

# Source code location

sonar.sources=src
sonar.tests=tests

# Language

sonar.language=py
sonar.python.version=3.11

# Coverage

sonar.python.coverage.reportPaths=coverage.xml

# Quality gates

sonar.qualitygate.wait=true
sonar.qualitygate.timeout=300

# Rules

sonar.python.pylint.reportPath=pylint-report.txt
sonar.python.xunit.reportPath=xunit-report.xml

# Run SonarQube scanner
sonar-scanner \
  -Dsonar.host.url=https://sonarqube.superbox.ai \
  -Dsonar.login=$SONAR_TOKEN \
  -Dsonar.projectKey=$PROJECT_KEY

# Wait for quality gate
quality_gate=$(curl -s \
  -u $SONAR_TOKEN: \
  "https://sonarqube.superbox.ai/api/qualitygates/project_status?projectKey=$PROJECT_KEY" \
  | jq -r '.projectStatus.status')

if [ "$quality_gate" != "OK" ]; then
  echo "Quality gate failed"
  exit 1
fi

Example SonarQube report:

{
  "projectStatus": {
    "status": "OK",
    "conditions": [
      {
        "status": "OK",
        "metricKey": "coverage",
        "comparator": "LT",
        "errorThreshold": "80",
        "actualValue": "85.3"
      },
      {
        "status": "OK",
        "metricKey": "security_rating",
        "actualValue": "1.0"
      },
      {
        "status": "OK",
        "metricKey": "reliability_rating",
        "actualValue": "1.0"
      }
    ],
    "periods": [],
    "ignoredConditions": false
  }
}

Security Rating: A - No security vulnerabilities

Reliability Rating: A - No bugs detected

Coverage: 85.3% - Exceeds 80% threshold

Step 2: Bandit Security Scanner

Overview
Common Issues
Configuration
Execution

Bandit scans Python code for common security issues:

B201-B506

50+ security checks for Python

Severity Levels

Low, Medium, High severity

Confidence Levels

Low, Medium, High confidence

Custom Rules

SuperBox-specific checks

B108: Hardcoded Temporary File

# ❌ Vulnerable
with open('/tmp/secrets.txt', 'w') as f:
    f.write(api_key)

# ✅ Secure
import tempfile
with tempfile.NamedTemporaryFile(delete=False) as f:
    f.write(api_key.encode())

B201: Flask Debug Mode

# ❌ Vulnerable
app.run(debug=True)

# ✅ Secure
app.run(debug=False)

B506: YAML Unsafe Load

# ❌ Vulnerable
import yaml
data = yaml.load(file)

# ✅ Secure
data = yaml.safe_load(file)

B608: SQL Injection

# ❌ Vulnerable
query = f"SELECT * FROM users WHERE id = {user_id}"

# ✅ Secure
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))

.bandit

# Bandit configuration
exclude_dirs:
  - /tests/
  - /venv/
  - /.venv/

# Skip specific tests

skips: - B101 # assert_used (common in tests)

# Severity thresholds

severity: - HIGH - MEDIUM
confidence: - HIGH - MEDIUM

# Custom plugins

plugins: - superbox_checks

# Run Bandit scanner
bandit -r src/ -f json -o bandit-report.json

# Parse results
python3 << EOF
import json

with open('bandit-report.json') as f:
    report = json.load(f)

# Check for high severity issues
high_severity = [
    issue for issue in report['results']
    if issue['issue_severity'] == 'HIGH'
]

if high_severity:
    print(f"Found {len(high_severity)} high severity issues")
    for issue in high_severity:
        print(f"  {issue['test_id']}: {issue['issue_text']}")
    exit(1)

print("✓ No high severity issues found")
EOF

Step 3: GitGuardian Secrets Detection

Overview
Detected Secrets
Configuration
Results

GitGuardian scans for exposed secrets and credentials:

350+ Detectors

API keys, tokens, passwords

High Accuracy

Low false positive rate

Real-time Scanning

Scans commits in real-time

Remediation

Automatic secret rotation

.gitguardian.yaml

version: 2

# Paths to scan
paths-ignore:
  - tests/fixtures/*.key
  - docs/examples/*.txt

# Custom detectors
detectors:
  - name: SuperBox API Key
    regex: 'sb_[a-zA-Z0-9]{32}'
    description: SuperBox API key

# Severity thresholds
exit-zero: false
minimum-occurrences: 1

# Outputs
output:
  - json
  - sarif

Example GitGuardian output:

{
  "secrets_found": [
    {
      "type": "AWS Access Key",
      "file": "config.py",
      "line": 23,
      "match": "AKIAIOSFODNN7EXAMPLE",
      "validity": "valid",
      "severity": "critical"
    }
  ],
  "total_secrets": 1,
  "total_occurrences": 1,
  "scan_id": "abc123"
}

Critical: AWS Access Key found in source code

Step 4: Semgrep Static Analysis

Overview
Security Rules

Semgrep performs lightweight static analysis to find bugs and vulnerabilities:

Pattern matching for security issues
Language-agnostic rules
Custom rule creation
Integration with CI/CD

semgrep-rules.yaml rules: - id: dangerous-eval pattern: eval($X)

message: Using eval() is dangerous severity: ERROR languages: [python] - id:
insecure-randomness pattern: random.random() message: Use secrets module for
security severity: WARNING languages: [python] - id: command-injection
patterns: - pattern: subprocess.call($CMD, shell=True) - pattern-not:
subprocess.call("...", shell=True) message: Command injection risk severity:
ERROR languages: [python] - id: path-traversal pattern: open(os.path.join(...,
$USER_INPUT)) message: Path traversal vulnerability severity: ERROR languages:
[python] ```
</Tab>

<Tab title="Execution">
  ```bash
# Run Semgrep
  semgrep --config=auto \
          --config=semgrep-rules.yaml \
          --json \
          --output=semgrep-report.json \
          src/
  
  # Check results
  if [ $(jq '.errors | length' semgrep-report.json) -gt 0 ]; then
    echo "Semgrep found security issues"
    jq '.errors' semgrep-report.json
    exit 1
  fi

Step 5: OWASP Dependency Check

Overview
Execution
Example Output

OWASP Dependency-Check identifies known vulnerabilities in dependencies:

Scans requirements.txt / package.json
Checks against NVD (National Vulnerability Database)
CVE identification
CVSS severity scoring

# Download dependency-check
wget https://github.com/jeremylong/DependencyCheck/releases/download/v8.0.0/dependency-check-8.0.0-release.zip
unzip dependency-check-8.0.0-release.zip

# Run scan
./dependency-check/bin/dependency-check.sh \
  --project "Weather MCP" \
  --scan requirements.txt \
  --format JSON \
  --out dependency-check-report.json

# Check for high/critical vulnerabilities
python3 << EOF
import json

with open('dependency-check-report.json') as f:
    report = json.load(f)

critical = sum(1 for dep in report.get('dependencies', [])
               for vuln in dep.get('vulnerabilities', [])
               if vuln.get('severity') in ['CRITICAL', 'HIGH'])

if critical > 0:
    print(f"Found {critical} critical/high vulnerabilities")
    exit(1)

print("✓ No critical vulnerabilities")
EOF

{
  "dependencies": [
    {
      "fileName": "requests-2.25.1-py2.py3-none-any.whl",
      "vulnerabilities": [
        {
          "name": "CVE-2023-32681",
          "cvssv3": {
            "baseScore": 6.1,
            "severity": "MEDIUM"
          },
          "description": "Requests Proxy-Authorization header leak",
          "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-32681"
          ]
        }
      ]
    }
  ]
}

Update requests to version 2.31.0 or later

Security Scoring

Each scan contributes to an overall security score:

Score Calculation
Score Grades
Example Report

def calculate_security_score(scan_results):
    score = 100
    
    # SonarQube penalties
    score -= scan_results['sonarqube']['bugs'] * 5
    score -= scan_results['sonarqube']['vulnerabilities'] * 10
    score -= scan_results['sonarqube']['code_smells'] * 0.5
    
    # Bandit penalties
    score -= scan_results['bandit']['high'] * 15
    score -= scan_results['bandit']['medium'] * 5
    
    # GitGuardian penalties
    score -= scan_results['gitguardian']['secrets'] * 50
    
    # Semgrep penalties
    score -= scan_results['semgrep']['errors'] * 10
    score -= scan_results['semgrep']['warnings'] * 2
    
    # OWASP penalties
    score -= scan_results['owasp']['critical'] * 20
    score -= scan_results['owasp']['high'] * 10
    score -= scan_results['owasp']['medium'] * 3
    
    return max(0, min(100, score))

{
  "server_id": "weather-mcp-123",
  "scan_timestamp": "2024-01-15T10:30:00Z",
  "overall_score": 92,
  "grade": "A",
  "status": "approved",
  "scans": {
    "sonarqube": {
      "status": "passed",
      "bugs": 0,
      "vulnerabilities": 0,
      "code_smells": 3,
      "coverage": 87.5
    },
    "bandit": {
      "status": "passed",
      "high": 0,
      "medium": 1,
      "low": 2
    },
    "gitguardian": {
      "status": "passed",
      "secrets": 0
    },
    "semgrep": {
      "status": "passed",
      "errors": 0,
      "warnings": 2
    },
    "owasp": {
      "status": "passed",
      "critical": 0,
      "high": 0,
      "medium": 1
    }
  }
}

CI/CD Integration

GitHub Actions Workflow

.github/workflows/security-scan.yml

name: Security Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: |
          pip install -r requirements.txt
          pip install bandit pytest pytest-cov

      - name: Run tests with coverage
        run: |
          pytest --cov=src --cov-report=xml

      - name: SonarQube Scan
        uses: sonarsource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

      - name: Bandit Security Scan
        run: |
          bandit -r src/ -f json -o bandit-report.json
          python scripts/check_bandit.py

      - name: GitGuardian Scan
        uses: GitGuardian/ggshield-action@master
        env:
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}

      - name: Semgrep Scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: auto

      - name: OWASP Dependency Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: "MCP Server"
          path: "."
          format: "JSON"

      - name: Upload Security Reports
        uses: actions/upload-artifact@v4
        with:
          name: security-reports
          path: |
            bandit-report.json
            semgrep-report.json
            dependency-check-report.json

Best Practices

Never hardcode secrets - Use environment variables

Keep dependencies updated - Regular security patches

Use parameterized queries - Prevent SQL injection

Validate all inputs - Sanitize user data

Enable security headers - XSS, CSRF protection

Implement rate limiting - Prevent abuse

Log security events - Audit trail

Regular security audits - Continuous improvement

Next Steps

MCP Servers

Learn about MCP protocol

Sandboxes

Lambda execution environment

CLI Push Command

Publish with security scanning

API Documentation

Explore API endpoints

Getting Started

Core Concepts

Infrastructure

Backend

Frontend

REST API

Servers API

Auth API

CLI

CLI Commands

​Overview

​Zero-Trust Security Model

SonarQube

Bandit

GitGuardian

Semgrep

OWASP

Manual Review

​Security Pipeline Architecture

​Pipeline Steps

​Step 1: SonarQube Analysis

​Step 2: Bandit Security Scanner

B201-B506

Severity Levels

Confidence Levels

Custom Rules

​Step 3: GitGuardian Secrets Detection

350+ Detectors

High Accuracy

Real-time Scanning

Remediation

​Step 4: Semgrep Static Analysis

​Step 5: OWASP Dependency Check

​Security Scoring

​CI/CD Integration

​GitHub Actions Workflow

​Best Practices

​Next Steps

MCP Servers

Sandboxes

CLI Push Command

API Documentation

Overview

Zero-Trust Security Model

Security Pipeline Architecture

Pipeline Steps

Step 1: SonarQube Analysis

Step 2: Bandit Security Scanner

Step 3: GitGuardian Secrets Detection

Step 4: Semgrep Static Analysis

Step 5: OWASP Dependency Check

Security Scoring

CI/CD Integration

GitHub Actions Workflow

Best Practices

Next Steps