Security

Letting a cloud agent reach tools on your laptop has to be safe by construction. These are the properties webmcp.fast is built around.

The daemon only dials out

The daemon opens one outbound WebSocket to the gateway. Your machine listens on no new port, and needs no tunnel, VPN or firewall change. Each device authenticates with an Ed25519 key generated on that device. The private key never leaves it, and revoking the device on the dashboard closes its connection at once.

One credential opens one endpoint

Every connector is bound to exactly one /<device>/<server>/mcp URL. An OAuth access token's audience must equal the URL it is presented to, and the grant names the same handle, device and server. A token for one endpoint is simply invalid at every other endpoint and on every other handle. Nothing is ever anonymous: an unauthenticated request, including initialize, gets 401.

The dashboard can only narrow exposure

A server can be added in one place only: on your machine, with webmcp attach. The gateway never asks a device to run anything. From the dashboard you can disable a server, remove it, require approval for new servers, revoke a device or disconnect an agent. Opening anything, even among servers you attached, also needs your passkey (see below): someone who got into your email or a dashboard session could switch things off, but could not connect an agent, create a token, enable a server or pair a device.

Choose which tools agents can reach

For each server you pick what agents may call: every tool (the default), only tools the server marks read-only, or a list you tick. An agent sees only the allowed tools, and a call to any other tool is refused at the gateway before it reaches your machine. This is the defence against prompt injection: if a web page or email talks your agent into calling something harmful, a tool you never allowed stays out of reach. Allowing more tools needs your passkey; allowing fewer does not.

No raw shell

The gateway has no tools of its own and the daemon exposes only the MCP servers you configured, each as the command or local URL you gave it. There is no "run a command" facility anywhere in the system.

Tenant isolation

The hostname is the only routing key. Each handle has its own Durable Object, and the audience check happens before that object is ever addressed. Tenant hostnames serve one static HTML page plus the MCP endpoints and their OAuth metadata, and read no cookies, which removes cross-tenant cookie and scripting problems.

Audit, without the content

Every relayed call records its time, device, server, MCP method, tool name, duration and outcome, kept for 30 days. Argument and result bodies are not recorded, and relayed traffic is not stored. The dashboard's Activity tab shows them. See the privacy policy.

Sign-in and passkeys

No passwords. You sign in with a 6-digit emailed code (stored hashed, valid for 10 minutes, single use, bound to the browser that asked for it) or with a passkey. Ten wrong codes pause email sign-in for that address until the next day (UTC); a passkey still works. An agent is never given the code.

Email only lets you look. Anything that opens access to your machine needs a passkey confirmation from the last 15 minutes: connecting an agent (including a setup agent's read-only view of your devices), creating a connector token, enabling a server, allowing more tools, pairing a device, or letting new servers skip approval. Only an existing passkey can add another. On an account that already has a paired device, the first passkey is started from that machine (webmcp passkey), so an inbox alone can never add one. A lost passkey is replaced with a single-use recovery code or a new link from your machine, never by email alone. Each of these actions also emails you, so a stolen session is noticed.

Credentials that end on their own

Connector tokens expire (90 days by default; you choose when you create one). An agent's OAuth connection ends after 30 days without use, so a stolen refresh token dies on its own. Both can be revoked at once on the dashboard.

No framing

No page of webmcp.fast can be shown inside another site (X-Frame-Options: DENY, frame-ancestors 'none'), so the consent screen's Allow button cannot be clicked through someone else's page.

Reporting a problem

Write to support@webmcp.fast with "security" in the subject. The technical detail is in the security model.