Security

We take the security of MCPStore seriously. This page describes our practices and how to report a vulnerability.

Responsible disclosure

If you discover a security vulnerability, please report it privately so we can fix it before it is disclosed publicly. Do not exploit the issue or access data that is not yours.

Our controls

• • Strict Content-Security-Policy with per-request nonces.
• • Zod input validation on every API endpoint.
• • Layered rate limiting on all read and write routes.
• • Parameterised database queries (no raw SQL from user input).
• • OAuth + single-use magic links; no stored passwords.
• • Append-only audit logging on privileged actions.
• • Honeypot and bot mitigation on all forms.