Security Pipeline

5-step automated security scanning for MCP servers

Overview

SuperBox implements a comprehensive 5-step security pipeline that automatically scans every MCP server before publication to ensure security, quality, and reliability.

Zero-Trust Security Model

Every MCP server undergoes rigorous automated security scanning before deployment.

SonarCloud

Code quality & security analysis

Tool Discovery

Validates MCP tools exist in source code

Snyk

Dependency vulnerability scanning

GitGuardian

Secrets and credentials scanning

Bandit

Python security vulnerability detection

Security Pipeline Architecture

Pipeline Steps

Step 1: SonarCloud Analysis

Overview

SonarCloud performs comprehensive code quality and security analysis:

Code Smells

Identifies maintainability issues:

• Complex functions
• Duplicated code
• Long parameter lists
• Cognitive complexity

Bugs

Detects potential runtime errors:

• Null pointer dereferences
• Resource leaks
• Logic errors
• Exception handling issues

Security Hotspots

Highlights security-sensitive code:

• SQL injection risks
• XSS vulnerabilities
• Insecure crypto usage
• Authentication bypasses

Code Coverage

Measures test coverage:

• Line coverage
• Branch coverage
• Function coverage
• Target: >80% coverage

Configuration

sonar-project.properties

sonar.projectKey=superbox-mcp-server
sonar.projectName=Weather MCP Server
sonar.projectVersion=1.0.0

# Source code location

sonar.sources=src
sonar.tests=tests

# Language

sonar.language=py
sonar.python.version=3.11

# Coverage

sonar.python.coverage.reportPaths=coverage.xml

# Quality gates

sonar.qualitygate.wait=true
sonar.qualitygate.timeout=300

# Rules

sonar.python.pylint.reportPath=pylint-report.txt
sonar.python.xunit.reportPath=xunit-report.xml

Execution

# Run SonarCloud scanner
sonar-scanner \
  -Dsonar.host.url=https://sonarcloud.io \
  -Dsonar.login=$SONAR_TOKEN \
  -Dsonar.projectKey=$PROJECT_KEY

# Wait for quality gate
quality_gate=$(curl -s \
  -u $SONAR_TOKEN: \
  "https://sonarcloud.io/api/qualitygates/project_status?projectKey=$PROJECT_KEY" \
  | jq -r '.projectStatus.status')

if [ "$quality_gate" != "OK" ]; then
  echo "Quality gate failed"
  exit 1
fi

Results

Example SonarCloud report:

{
"projectStatus": {
 "status": "OK",
 "conditions": [
{
"status": "OK",
"metricKey": "coverage",
"comparator": "LT",
"errorThreshold": "80",
"actualValue": "85.3"
},
{
"status": "OK",
"metricKey": "security_rating",
"actualValue": "1.0"
},
{
"status": "OK",
"metricKey": "reliability_rating",
"actualValue": "1.0"
}
 ],
 "periods": [],
 "ignoredConditions": false
}
}

Security Rating: A - No security vulnerabilities

Reliability Rating: A - No bugs detected

Coverage: 85.3% - Exceeds 80% threshold

Step 2: Tool Discovery

The repository is cloned to a temp directory. Source files are scanned with regex to find all MCP tool definitions - functions decorated with @*.tool().

If no tool definitions are found, superbox push fails with a list of expected function names.

Step 3: Snyk Dependency Scan

Snyk scans requirements.txt for known CVEs in Python dependencies.

CVE Detection

Checks against Snyk’s vulnerability database

Severity Levels

Critical, High, Medium, Low

The scan fails the pipeline on any critical or high severity findings.

Step 4: GitGuardian Secrets Detection

Overview

GitGuardian scans for exposed secrets and credentials:

350+ Detectors

API keys, tokens, passwords

High Accuracy

Low false positive rate

Detected Secrets

Common secrets detected:

• Cloud provider access keys
• GitHub tokens (ghp_…)
• OpenAI API keys (sk-…)
• Database URLs (postgres://user:pass@…)
• Private keys (-----BEGIN RSA PRIVATE KEY-----)
• JWT tokens
• Stripe API keys (sk_live_…)

Results

Example output when a secret is found:

{
"secrets_found": [
 {
"type": "AWS Access Key",
"file": "config.py",
"line": 23,
"match": "AKIAIOSFODNN7EXAMPLE",
"severity": "critical"
 }
],
"total_secrets": 1
}

Critical: Exposed credential found in source code. Remove secrets before pushing.

Step 5: Bandit Security Audit

Overview

Bandit scans Python code for common security issues:

50+ checks

B201-B506 security rules for Python

Severity Levels

Low, Medium, High

Common Issues

B108: Hardcoded Temporary File

# Bad
with open('/tmp/secrets.txt', 'w') as f:
f.write(api_key)

# Good
import tempfile
with tempfile.NamedTemporaryFile(delete=False) as f:
f.write(api_key.encode())

B201: Flask Debug Mode

# Bad
app.run(debug=True)

# Good
app.run(debug=False)

B608: SQL Injection

# Bad
query = f"SELECT * FROM users WHERE id = {user_id}"

# Good
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))

Security Scoring

Each scan contributes to an overall security score:

Score Calculation

def calculate_security_score(scan_results):
 score = 100

 # SonarCloud penalties
 score -= scan_results['sonarcloud']['bugs'] * 5
 score -= scan_results['sonarcloud']['vulnerabilities'] * 10

 # Snyk penalties
 score -= scan_results['snyk']['critical'] * 20
 score -= scan_results['snyk']['high'] * 10

 # GitGuardian penalties
 score -= scan_results['gitguardian']['secrets'] * 50

 # Bandit penalties
 score -= scan_results['bandit']['high'] * 15
 score -= scan_results['bandit']['medium'] * 5

 return max(0, min(100, score))

Score Grades

Score	Grade	Status
95-100	A+	Excellent - Auto-approved
85-94	A	Good - Auto-approved
75-84	B	Fair - Manual review
65-74	C	Needs improvement
0-64	F	Rejected - Fix issues

Example Report

{
"server_id": "weather-mcp-123",
"scan_timestamp": "2024-01-15T10:30:00Z",
"overall_score": 92,
"grade": "A",
"status": "approved",
"scans": {
 "SonarCloud": {
"status": "passed",
"bugs": 0,
"vulnerabilities": 0,
"code_smells": 3,
"coverage": 87.5
 },
 "bandit": {
"status": "passed",
"high": 0,
"medium": 1,
"low": 2
 },
 "gitguardian": {
"status": "passed",
"secrets": 0
 },
 "snyk": {
"status": "passed",
"critical": 0,
"high": 0
 },
 "tool_discovery": {
"status": "passed",
"tools_found": 3
 }
}
}

Best Practices

Never hardcode secrets - Use environment variables

Keep dependencies updated - Regular security patches

Use parameterized queries - Prevent SQL injection

Validate all inputs - Sanitize user data

Implement rate limiting - Prevent abuse

Log security events - Audit trail

Next Steps

MCP Servers

Learn about MCP protocol

Sandboxes

Cloudflare Durable Object sandboxes

CLI Push Command

Publish with security scanning

API Documentation

Explore API endpoints