Security model

Layer	What it does
Bearer token	Requests without the exact token get 401. The comparison runs in constant time.
OAuth 2.1	/mcp supports OAuth with PKCE (S256) and dynamic client registration. Approving a client requires the access key. Access tokens last 1 hour; refresh tokens rotate. Grants are stored in the 911cpb-mcp-oauth KV namespace.
Bearer token / API key	X-API-Key: <token> is accepted as an alternative header for the same token.
Path check	Only /mcp, /api/* and the public /openapi.json are served; everything else returns 404.
Statement checks	One read-type statement per call; transaction control and SET are rejected (details).
READ ONLY transaction	Postgres refuses writes, including writes hidden in CTEs.
Aurora reader endpoint	Connects to a read replica, which can’t write to tables at all.
Database permissions	The skye role lacks write grants on at least some tables.
Timeout & row cap	15 s per statement, 500 rows per response.

Known gaps

• Shared personal credentials. Hyperdrive connects as skye. Move it to a dedicated role with SELECT-only grants (and no access to AuditEvent).
• Password exposure. The database password was shared in plain text during setup. Rotate it, then update Hyperdrive.
• Public database. The Aurora endpoint accepts connections from the internet. Restrict its security group to Cloudflare IP ranges if nothing else needs it.
• Single shared token. Every key-based client uses the same token, and the same key approves OAuth clients. Rotate it if it leaks. Rotating it doesn’t revoke OAuth grants already issued; clear the 911cpb-mcp-oauth KV namespace to sign out every OAuth client.
• Open client registration. Anyone can register an OAuth client, but nobody can get a token without approving it with the access key.