Security
Security Best Practices and Authentication
Security best practices and authentication patterns for RouterMCP.
Security
RouterMCP provides multiple layers of security for protecting your MCP gateway and upstream servers.
MCP tools can have significant capabilities. Always review and restrict tool access based on the principle of least privilege.
Security Layers
| Layer | Description |
|---|---|
| API Key Authentication | Require keys for project access |
| Tool Filtering | Control which tools are exposed |
| OAuth Integration | Secure upstream authentication |
| Audit Logging | Track all operations |
| Code Mode Sandbox | Isolated JavaScript execution |
Documentation
Quick Recommendations
- Enable API key authentication for all production projects
- Use tool filtering to expose only necessary tools
- Rotate API keys periodically
- Review audit logs for suspicious activity
- Use per-server credentials instead of shared tokens