MCP Security

Address Management

• We do not leave AI coding connection information in public documents, chat rooms, or source repositories.
• Deliver only to trusted AI tools and workers.
• Your address will automatically renew at 00:00 KST every day and your old address will no longer be available.
• The address issued on the AI ​​coding screen is linked to the issuing administrator or owner account. Memos and messages can only be viewed and changed with the appropriate account permissions.
• If the address has been exposed, the current address will be immediately discarded using the reissue button.

Administrator Login

• For the operating domain, log in with cake20.com's Google account and administrator privileges.
• Google login URLs and completion redirects created by a production Core use the public Hub origin and never expose 127.0.0.1 or localhost to the browser.
• localhost logs in with the 12+ character MANAGER_PASSWORD in .env.
• Local login sessions are retained for 30 days with an HttpOnly cookie.
• If there are more than 5 local failures, logins from that address will be restricted for 15 minutes.

Task status and automatic shutdown

The MCP task records only the modifying state without any locks, and the new begin_work Replace the Incomplete status with a new task. Users can edit together in the editor there is. Text and binary writes apply the latest complete content, so AI reads the current file immediately before writing and preserves other changes. MCP and local folders and files can be created, renamed, Content changes and deletions are reflected in real time in the file list and open tabs. After begin_work, only one of the general MCP requests/notifications or pings from the same AI is active. Process it as a signal. Even when a request is being executed, it is considered an activity, and the last AI only uses a separate ping tool when there are no new requests within 3 minutes of a regular request. Call it directly. Before thinking, planning, or waiting for a long time, ping first. Send, and repeat every 3 minutes if the no signal condition continues.

• Simple keep-alive, HTTP keep-alive, open connections, local parsing, and shell commands are not activity signals.
• If no known server activity is in progress and there has been no activity for 20 minutes, it will terminate with a timeout.
• timeout·error·normal completion The modification status is completed immediately and does not wait for user confirmation.
• Timeouts and errors remain as red notifications in the editor and disappear when the user closes them.
• When the user presses the stop button, the ongoing AI/MCP request and Preview are immediately terminated.
• When an existing AI that has been auto-terminated returns, begin_work must be called again with a new user request.

server safety device

• We verify all 48-digit control keys of the day included in the website ID and address.
• Block unauthorized Origin requests.
• Block access to paths and symbolic links outside the website root.
• Row-only CRUD tools limit their target scope by parameters and primary keys.
• General-purpose SQL is run with reduced privileges using a website-specific non-login role.
• The execute_db session cannot be transferred to another website or server permission role.
• Database reads stay inside the website-specific role, and Redis reads stay inside the website prefix. Shared-data writes remain limited to the scope included in the current user request.
• Database writes create an automatic pre-change backup, restore it on failure, and do not stop the release. Use create_site_backup before broad changes.
• A command to force a website-specific prefix to the Redis key from the server and receive a different key is not provided.
• clear_redis also searches for and deletes only the keys that match the website prefix.
• Row-only CRUD tools limit you to 100 rows at a time and rollback the entire thing on failure.
• Updates and deletions require complete primary keys, and deletion runs only when the current request includes the exact target.
• Text and binary writes apply the latest complete content. AI must reread a file immediately before writing and preserve unrelated changes.
• When an MCP calls begin_work, it records a modifying status without locking, and the new work Replace any remaining incomplete status. Users can edit together in the editor, and a late save of the same file becomes the latest content, so the writer must inspect the file immediately before saving.
• When finish_work is called, completion details are accumulated in the editor and the modification status is immediately updated. Finished. The following MCP tasks can be started without separate confirmation from the user.
• Unrecoverable errors are terminated with a status error in finish_work, and If there is no MCP activity signal for 20 minutes without server activity, it will terminate with a timeout. Errors and timeouts are also immediately modified without user confirmation.
• The editor displays AI/model name, connection IP, work details, and elapsed time. Users can immediately terminate AI/MCP requests and previews with the stop button.
• An aborted MCP task will receive cancellation notification on the next change tool call. The task cannot be restarted without a new user request.
• A valid expiration address is MCP_ADDRESS_EXPIRED, expiration time, and website name. Returns obsolete or invalid addresses as MCP_ADDRESS_REVOKED_OR_INVALID. Separate. We don't expose your website name to random invalid keys.
• read_asset·write_asset·upload_files allows binaries less than 2MB per file. Processing, upload_files only creates new paths and does not overwrite existing files.
• Binary MCP tools only support images, fonts, PDFs, audio and video extensions. Allows to prevent code files from bypassing lint and text storage rules.
• request_service calls only the loopback address of the website and hosts, forwarded, Block headers related to client IP.
• get_settings returns only the Secret name, update_settings and activity history return Secret It leaves no value.
• The Git tool only runs on the local repository of the connected website and does not provide arbitrary commands and remote access.
• git_restore requires a full commit SHA, explicit confirmation and internal path to the website, and automatically commits the current changes before restoring.
• A 2MB per MCP file and administrator-wide capacity limit applies.
• The Notes and Messages tool uses a signed internal AI account or the account that issued the MCP address. It is used to enforce the administrator/owner's memo range and message destination on the server.
• MCP tools that change DB·Redis·file·setting·Git·build·deployment·task status and Only failed requests are stored in the website's integrated activity history along with secure destination information.