Security¶

NEON tokens¶

• A token is used only as the X-API-Token header to data.neonscience.org — never in a URL, never to a storage host (signed download URLs need no token).
• It never appears in logs (a redaction processor masks credential-like keys and every token the process has seen), results, error details, cache keys (a 12-character SHA-256 prefix identifies it instead), /healthz, /readyz, or MRTR requestState.
• There is no command-line flag for it (process lists and shell history would expose it).
• Over HTTP a per-request token is accepted only when server.public_base_url is https://, and the operator's own token is not lent to anonymous callers unless server.share_config_token_over_http is set — only do that on private deployments.

Requests¶

• DNS-rebinding protection: loopback binds are protected automatically; public deployments get a Host/Origin allow-list from public_base_url, allowed_hosts and allowed_origins¹.
• Request bodies are capped at 1 MiB; GET/DELETE on /mcp are refused (no idle streams); results are capped at 50 KB (trimmed) and 200 KB (hard).
• Every NEON call goes through a per-identity rate limiter kept 10 % under NEON's limits.
• neon_graphql accepts only read-only queries against allow-listed roots, bounded in length and depth.

Downloads (stdio only)¶

• The download tool is not listed and refuses to run over HTTP.
• Destinations must resolve (following symlinks) inside downloads.directory; file names must match ^[A-Za-z0-9._-]+$; dest_subdir must be relative without ...
• Every URL and redirect hop must be on downloads.allowed_hosts; the plan is refused before any transfer above 50 files / 2 GiB per call or 1 GiB per file.
• Files stream to .part and are renamed only after the MD5 check passes.

Reporting¶

Report vulnerabilities privately through GitHub's security advisories for idss-mesa/neon-mcp.