Security by design, gaps included
Credentials protected. Access under control.
Passport puts one governed gateway between the AI clients people use and the MCP servers they connect. Members connect once and go, while every call stays scoped, attributed, and revocable.
Review the evidence, not a promise.
Our security posture, DPA and SCCs, subprocessors, live status, and current assurance gaps are public.
Credentials protectedProvider tokens, company keys, and identity secrets stay encrypted at the gateway.
Least-privilege accessApply access by workspace, team, person, client, and governed tool.
Central revocationEnd sessions, clients, and account grants from Passport or through SCIM.
Attributable activitySee who used which client, MCP, and tool, and whether it was allowed or blocked.
The data path
The AI client never needs the upstream credential.
Passport evaluates access before presenting a provider credential to the MCP server on the user's behalf.
AI clientReceives scoped Passport access
Passport gatewayEncrypts credentials · evaluates access · attributes governed calls
MCP serverReceives its credential only for an allowed request
Technical evidence
Go deeper where your review needs it.
The important outcomes come first. Implementation details remain available for security and procurement teams.
Credentials
Upstream credentials stay out of AI-client configsHosted clients receive a scoped Passport grant; upstream credentials remain encrypted at the gateway. Local clients use the Passport bridge instead of copying upstream OAuth tokens or API keys into mcp.json.
Encrypted at rest, rotatable keysUpstream OAuth tokens, company keys, and IdP secrets are AES-256-GCM encrypted under a keyring with an operator-run rekey tool. Passport-issued tokens are stored only as SHA-256 digests; raw values are delivered exactly once.
Verified sign-inA typed email is a claim, not an identity: browser sign-in mails a single-use, expiring link. Workspace joining is invite-only by default, with an opt-in company-domain policy, re-checked when a link is redeemed.
Isolation
Every workspace is its own worldPer-workspace documents and event logs, workspace-prefixed credentials, and version-guarded writes. Cross-tenant isolation is exercised by a dedicated end-to-end test on every commit.
Standards-based inbound OAuthHosted and direct clients connect through OAuth 2.1 with PKCE, single-use codes, rotating refresh credentials, bounded concurrency overlap, and stale-replay detection.
Network egress guardedAdmin-supplied URLs (MCP endpoints, webhooks, SIEM, SSO discovery) pass SSRF checks: DNS resolution against private ranges and cloud metadata endpoints, re-validated on every redirect hop.
Catalog and gateway controls
Catalog endpoints carry dated checksPassport records a point-in-time MCP handshake, transport, and sign-in classification. Registry changes ship as reviewed diffs because those URLs decide where member credentials are presented.
Openly observable toolsets are hash-pinnedWhere an open endpoint exposes definitions before sign-in, Passport records a definition hash and bounded injection-pattern scan. This is change evidence, not a security guarantee.
Governance at the gateway, not in the promptRead-only passes, per-tool kill switches, and secret-detection guardrails are enforced server-side on every call. An AI client cannot talk its way past them.
Accountability
Everything attributed and auditableEvery governed action is evaluated and attributed to a member or named agent. The trail includes the client, tool, and outcome; admin actions are exportable as CSV/JSONL, with SIEM/OTLP streaming on the Enterprise plan.
Activity minimizes sensitive contentThe governed-call trail records who, client, MCP, tool, outcome, and timing, but not model conversations, full tool arguments, or tool results.
Deletion is realRemoving a person revokes their sessions everywhere and drops their grants. Deleting a workspace purges its document and event log, not a soft delete.
Production configuration checksA production deployment refuses to boot without an encryption key, an https origin, and explicit signup/demo settings. CI runs secret scanning, dependency audit, and SAST on every change.
Deployment choices
Use the hosted servicePassport hosts the application and workspace database in the United States. The current infrastructure providers and their roles are listed on the public Subprocessors page.
Self-host it entirelyPassport is a single container plus Postgres. Run it in your own VPC with your own keys; the hosted service never touches your data. The gateway, catalog, and governance are identical. See the self-host guide.
Reporting a vulnerability
How to reportEmail security@passportmcp.com with what you found and how to reproduce it. The machine-readable policy is at /.well-known/security.txt.
What to expectWe acknowledge within 2 business days and keep you updated through the fix. We credit reporters who want the credit. There is no paid bug bounty yet, and we would rather say so than imply one.
What we have not earned yet
No SOC 2 report, independent third-party penetration-test report, independent uptime history, or contractual SLA/RTO/RPO is published during early access. The Trust summary keeps those boundaries explicit.
The standard DPA and SCC terms are public. Full data-handling details: Privacy. Who we rely on: Subprocessors.