Your agents never hold your keys.
Passport puts one gateway between the agents people use and the apps they connect. People connect once, and every call stays scoped, attributed, and revocable.
Credentials protectedProvider tokens, company keys, and identity secrets stay encrypted at the gateway.
Least-privilege accessApply access by workspace, team, person, agent, and tool.
Central revocationEnd sessions, agents, and account grants from Passport or through SCIM.
Attributable activitySee who used which agent, app, and tool, and whether it was allowed or blocked.
How a call gets through.
Passport checks who is asking, which app, and which action. Only then does it present the app's credential on the person's behalf.
Agent
Signs in to Passport. Holds no app credentials, in memory or in config files.
Passport sign-in
Passport
Keeps app credentials encrypted. Checks who is asking, which app, and which action.
GitHub token · encrypted
Allowed by rule
allowed call only
App
Receives Passport's credential only for calls your rules allow.
Issue created
Go deeper where your review needs it.
The outcomes come first. Implementation details stay available for security and procurement teams.
Credentials
Upstream credentials stay out of agent configsHosted agents receive a scoped Passport grant; upstream credentials remain encrypted at the gateway. Local agents use the Passport bridge instead of copying upstream OAuth tokens or API keys into mcp.json.
Encrypted at rest, rotatable keysUpstream OAuth tokens, company keys, and IdP secrets are AES-256-GCM encrypted under a keyring with an operator-run rekey tool. Passport-issued tokens are stored only as SHA-256 digests; raw values are delivered exactly once.
Verified sign-inA typed email is a claim, not an identity: browser sign-in mails a single-use, expiring link. Workspace joining is invite-only by default, with an opt-in company-domain policy, re-checked when a link is redeemed.
Isolation
Every workspace is its own worldPer-workspace documents and event logs, workspace-prefixed credentials, and version-guarded writes. Cross-tenant isolation is exercised by a dedicated end-to-end test on every commit.
Standards-based inbound OAuthHosted and direct agents connect through OAuth 2.1 with PKCE, single-use codes, rotating refresh credentials, bounded concurrency overlap, and stale-replay detection.
Network egress guardedAdmin-supplied URLs (MCP endpoints, webhooks, SIEM, SSO discovery) pass SSRF checks: DNS resolution against private ranges and cloud metadata endpoints, re-validated on every redirect hop.
Catalog and gateway controls
Catalog endpoints carry dated checksPassport records a point-in-time MCP handshake, transport, and sign-in classification. Registry changes ship as reviewed diffs because those URLs decide where member credentials are presented.
Openly observable toolsets are hash-pinnedWhere an open endpoint exposes definitions before sign-in, Passport records a definition hash and bounded injection-pattern scan. This is change evidence, not a security guarantee.
Governance at the gateway, not in the promptRead-only access, per-tool switches, and secret-detection guardrails are enforced server-side on every call. An agent can't talk its way past them.
Accountability
Everything attributed and auditableEvery governed action is evaluated and attributed to a member or named agent. The trail includes the agent, tool, and outcome; admin actions are exportable as CSV or JSONL, with SIEM and OTLP streaming on the Enterprise plan.
Activity minimizes sensitive contentThe governed-call trail records who acted, the agent, app, tool, outcome, and timing, but not model conversations, full tool arguments, or tool results.
Deletion is realRemoving a person revokes their sessions everywhere and drops their grants. Deleting a workspace purges its document and event log, not a soft delete.
Production configuration checksA production deployment refuses to boot without an encryption key, an https origin, and explicit signup and demo settings. CI runs secret scanning, dependency audit, and SAST on every change.
Deployment choices
Use the hosted servicePassport hosts the application and workspace database in the United States. The current infrastructure providers and their roles are listed on the public Subprocessors page.
Self-host it entirelyPassport is a single container plus Postgres. Run it in your own VPC with your own keys; the hosted service never touches your data. The gateway, catalog, and rules are identical. Read the self-hosting guide.
Reporting a vulnerability
How to reportEmail security@passportmcp.com with what you found and how to reproduce it. The machine-readable policy is at /.well-known/security.txt.
What to expectWe acknowledge within 2 business days and keep you updated through the fix. We credit reporters who want the credit. There is no paid bug bounty yet, and we would rather say so than imply one.
What we have not earned yet
No SOC 2 report, independent third-party penetration-test report, independent uptime history, or contractual SLA, RTO, or RPO is published during early access. The trust summary keeps those boundaries explicit.
The standard DPA and SCC terms are public. Full data-handling details: Privacy. Who we rely on: Subprocessors.