Security and data protection

Isolation

• Every server runs in its own container with gVisor – an extra user-space kernel that separates the container from the host.
• Limits for CPU, memory and processes, read-only file system, no Linux capabilities.
• A separate network per server. Outbound traffic only to the hosts you allow; our internal network and other customers are unreachable.

Credentials

• Encrypted with AES-256-GCM; the master key is not stored in the database.
• Entered once, never shown again – replace only, never read back.
• Masked in logs and error messages. Deleted when a server is deleted.

Sign-in and access

• OAuth 2.1 following the MCP specification, with PKCE and tokens bound to a single server.
• Everyone signs in individually; access can be revoked per person and per client and takes effect at once.
• Server addresses live on xenmcp.com, separate from our other services – third-party code shares no cookies with our websites.

Logs and data

• We log tool, status, duration and time of a call – not the arguments and not the results.
• Hosting and backups in Germany. No US provider’s content delivery network in front of the gateway.
• Your systems’ answers go to the AI client you use (with Claude, to Anthropic). You decide which client to use.

Supply chain

• We build catalog servers ourselves from a pinned version; we do not pull third-party images.
• Before release we read every tool description for hidden instructions to the AI (tool poisoning).
• Write tools are annotated so your AI client asks before running them.

Contracts

• Data processing agreement (DPA/AVV) for companies.
• Description of technical and organisational measures (TOM) on request.
• Later: running the gateway in your own network (on-premise).

Connecting databases safely

A dedicated read-only user and a firewall rule for XenMCP’s fixed IP only – instead of opening the database to the whole internet. Read the guide →

Found a vulnerability? Write to hello@xenmcp.com.