Security Audit Checklist

Overview

This checklist covers all critical security areas that should be audited before and during production deployment. Use this as a systematic guide to ensure your MCP Server deployment meets security best practices.

Do not deploy to production until all critical items are addressed. High and critical items must be resolved; medium items should be planned for resolution.

Authentication & Authorization

Keycloak Configuration

✅ Keycloak Setup

Critical:

Admin password changed from default
Admin console access restricted to internal network
HTTPS enabled for all Keycloak endpoints
Session timeout configured (max 24 hours)
Brute force detection enabled
Email verification required for new users

High:

MFA/2FA enabled for admin accounts
Password policy enforced (min 12 characters, complexity)
Account lockout after failed attempts
Security headers configured
CORS properly configured

Verification:

# Check admin password
kubectl exec -it keycloak-0 -n mcp-server-langgraph -- \
  /opt/keycloak/bin/kcadm.sh get users/admin

# Verify HTTPS
curl -I https://auth.yourdomain.com

# Check brute force settings
kubectl exec -it keycloak-0 -n mcp-server-langgraph -- \
  /opt/keycloak/bin/kcadm.sh get realms/mcp-agent | grep bruteForce

✅ JWT Configuration

Critical:

JWT secret is cryptographically secure (>= 32 bytes)
JWT secret rotated from default value
JWT secret stored in secret management system
Token expiration set appropriately (< 1 hour)
Refresh token rotation enabled
Algorithm set to RS256 or ES256 (not HS256)

High:

JWK rotation configured
Token revocation mechanism implemented
Audience (aud) claim validated
Issuer (iss) claim validated

Verification:

# Check JWT secret length
kubectl get secret mcp-server-langgraph-secrets -n mcp-server-langgraph \
  -o jsonpath='{.data.JWT_SECRET}' | base64 -d | wc -c

# Verify token expiration
# Decode a JWT token and check 'exp' claim

✅ OpenFGA Authorization

Critical:

Authorization model defined and tested
Default deny policy in place
Admin access properly restricted
Permission checks on all sensitive operations
OpenFGA TLS enabled

High:

Authorization logging enabled
Regular audit of permission tuples
Least privilege principle enforced
Authorization tests in CI/CD

Verification:

# Test authorization
curl -X POST http://openfga:8080/stores/xxx/check \
  -H "Content-Type: application/json" \
  -d '{
    "tuple_key": {
      "user": "user:alice",
      "relation": "admin",
      "object": "organization:acme"
    }
  }'

# Check TLS
kubectl get svc openfga -n mcp-server-langgraph -o yaml | grep tls

Secrets Management

Infrastructure Secrets

✅ Secret Storage

Critical:

No secrets in code or git repository
All secrets in Infisical/Vault/Cloud Secret Manager
.env files in .gitignore
Container images don’t contain secrets
Kubernetes secrets encrypted at rest

High:

Secret rotation policy defined (90 days max)
Automated secret rotation configured
Secret access auditing enabled
Secrets have expiration dates

Verification:

# Check for secrets in git
git secrets --scan

# Check for hardcoded secrets
grep -r "ANTHROPIC_API_KEY\|sk-ant-" src/

# Verify Kubernetes encryption
kubectl get secret mcp-server-langgraph-secrets -n mcp-server-langgraph \
  -o yaml | grep -i encrypt

✅ API Keys

Critical:

LLM API keys rotated from initial values
API keys have usage limits configured
API keys scoped to minimum permissions
Backup API keys available

High:

API key usage monitoring enabled
Alerts on suspicious API usage
API keys rotated every 90 days

Verification:

# Check API key age
kubectl get secret mcp-server-langgraph-secrets -n mcp-server-langgraph \
  -o json | jq '.metadata.creationTimestamp'

# Monitor Anthropic usage
curl https://api.anthropic.com/v1/usage \
  -H "x-api-key: $ANTHROPIC_API_KEY"

✅ Database Credentials

Critical:

Database passwords changed from defaults
Database users have minimum required privileges
Production database not accessible from internet
SSL/TLS enforced for database connections

High:

Database password rotation configured
Connection pooling with authentication
Database audit logging enabled

Verification:

# Test database connection
PGPASSWORD=$DB_PASSWORD psql -h $DB_HOST -U $DB_USER -c "SELECT version();"

# Check SSL
PGPASSWORD=$DB_PASSWORD psql -h $DB_HOST -U $DB_USER \
  -c "SHOW ssl;" | grep on

Network Security

Network Configuration

✅ TLS/SSL

Critical:

HTTPS enabled for all public endpoints
Valid TLS certificates (not self-signed)
TLS 1.2+ only (1.0/1.1 disabled)
Strong cipher suites configured
HSTS header enabled

High:

Certificate auto-renewal configured
Certificate expiry monitoring
OCSP stapling enabled
Perfect forward secrecy (PFS) enabled

Verification:

# Check TLS version
nmap --script ssl-enum-ciphers -p 443 api.yourdomain.com

# Test SSL configuration
testssl.sh https://api.yourdomain.com

# Check HSTS
curl -I https://api.yourdomain.com | grep Strict-Transport-Security

✅ Network Policies

Critical:

Network policies defined for all namespaces
Default deny ingress/egress in place
Least privilege network access
Pods can’t access cluster API by default

High:

Network policies tested
Egress filtering configured
Service mesh for mTLS (optional)

Verification:

# List network policies
kubectl get networkpolicies -A

# Test connectivity
kubectl run test --rm -it --image=alpine -- sh
# Try to connect to restricted services

✅ Firewall & Load Balancer

Critical:

Only required ports exposed
Admin interfaces not publicly accessible
Rate limiting configured
DDoS protection enabled

High:

WAF rules configured
IP whitelisting for admin access
Geographic restrictions (if applicable)
Load balancer health checks configured

Verification:

# Check exposed ports
nmap -p- api.yourdomain.com

# Test rate limiting
ab -n 1000 -c 100 https://api.yourdomain.com/

# Check firewall rules
gcloud compute firewall-rules list  # GCP
aws ec2 describe-security-groups    # AWS

Application Security

Code Security

✅ Dependencies

Critical:

No critical vulnerabilities in dependencies
All dependencies from trusted sources
Lock files committed (requirements.txt, package-lock.json)
Dependency scanning in CI/CD

High:

Regular dependency updates
Automated vulnerability scanning
SBOM (Software Bill of Materials) generated

Verification:

# Scan Python dependencies
pip-audit

# Scan with safety
safety check

# Check for outdated packages
pip list --outdated

✅ Input Validation

Critical:High:

Input sanitization
Output encoding
CSRF protection
Rate limiting per endpoint

Verification:

# Review input validation
grep -r "request.query" src/
grep -r "request.body" src/

# Check for Pydantic models
find src/ -name "*.py" -exec grep -l "BaseModel" {} \;

✅ Logging & Monitoring

Critical:

Security events logged
Sensitive data not logged (passwords, tokens)
Logs centralized and searchable
Log retention policy defined

High:

Structured logging (JSON)
Log tampering prevention
Alerting on security events
SIEM integration

Verification:

# Check for sensitive data in logs
kubectl logs deployment/mcp-server-langgraph -n mcp-server-langgraph | \
  grep -i "password\|secret\|token"

# Verify structured logging
kubectl logs deployment/mcp-server-langgraph -n mcp-server-langgraph | jq .

Container Security

Image Security

✅ Container Images

Critical:

Images from trusted registries only
Image vulnerability scanning enabled
No critical vulnerabilities in images
Images signed and verified
Non-root user in containers

High:

Minimal base images (distroless, alpine)
Multi-stage builds
Image scanning in CI/CD
Regular image updates

Verification:

# Scan image
trivy image mcp-server-langgraph:latest

# Check for root user
docker inspect mcp-server-langgraph:latest | grep -i "user"

# Verify image signature
cosign verify mcp-server-langgraph:latest

✅ Runtime Security

Critical:High:

Pod Security Standards enforced
Runtime security monitoring (Falco)
Resource limits defined

Verification:

# Check security context
kubectl get pod mcp-server-langgraph-${POD_ID} -n mcp-server-langgraph \
  -o yaml | grep -A 10 securityContext

# Verify Pod Security Standards
kubectl label namespace mcp-server-langgraph \
  pod-security.kubernetes.io/enforce=restricted

Data Protection

Data Security

✅ Encryption

Critical:

Data encrypted in transit (TLS)
Data encrypted at rest (database, Redis, volumes)
Encryption keys managed securely
Kubernetes secrets encrypted

High:

Key rotation configured
HSM or KMS for key management
Encryption for backups

Verification:

# Check database encryption
kubectl exec postgres-0 -n mcp-server-langgraph -- \
  psql -c "SHOW ssl;" | grep on

# Check Redis TLS
redis-cli -h redis-master --tls ping

# Verify Kubernetes encryption
kubectl get secret -n kube-system encryption-config

✅ Backup & Recovery

Critical:High:

Point-in-time recovery available
Backup monitoring and alerts
DR plan documented

Verification:

# List backups
velero backup get

# Test restore (in staging)
velero restore create --from-backup backup-name

# Check backup encryption
aws s3api get-object --bucket backups --key latest \
  --server-side-encryption AES256

✅ Data Privacy

Critical:High:

Consent management
Data portability
Privacy by design
GDPR/CCPA compliance (if applicable)

Verification:

# Check for PII logging
grep -r "email\|phone\|ssn" src/logs/

# Verify data deletion
# Test user deletion endpoint

Kubernetes Security

Cluster Security

✅ RBAC

Critical:High:

Regular RBAC audit
Namespaced roles
RBAC testing

Verification:

# List cluster roles
kubectl get clusterrolebindings

# Check service account permissions
kubectl auth can-i --list --as=system:serviceaccount:mcp-server-langgraph:mcp-server-langgraph

# Audit RBAC
kubectl auth reconcile -f rbac.yaml --dry-run

✅ Pod Security

Critical:High:

SecurityContext on all pods
runAsNonRoot enforced
allowPrivilegeEscalation: false

Verification:

# Check Pod Security Admission
kubectl get ns mcp-server-langgraph -o yaml | grep pod-security

# Scan for privileged pods
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.securityContext.privileged}{"\n"}{end}'

✅ API Server

Critical:High:

API rate limiting
Webhook timeout configured
Audit logs reviewed regularly

Verification:

# Check API server access
kubectl cluster-info

# Verify audit log
kubectl get pods -n kube-system | grep kube-apiserver

# Check admission controllers
kubectl -n kube-system get pod kube-apiserver-xxx \
  -o yaml | grep enable-admission-plugins

Compliance & Governance

Compliance

✅ Security Policies

Critical:High:

Security champions assigned
Regular security reviews
Penetration testing scheduled
Bug bounty program (optional)

Verification:

Review policy documents
Check training records
Verify incident response tests

✅ Audit & Compliance

Critical:

Audit logs enabled everywhere
Compliance requirements identified
Regular compliance audits
Audit log retention (1 year min)

High:

SOC 2 / ISO 27001 certification
GDPR/CCPA compliance
Third-party audits
Compliance automation

Verification:

# Check audit logs
kubectl logs -n kube-system kube-apiserver-xxx | grep audit

# Verify log retention
kubectl get cm -n kube-system audit-policy -o yaml

Pre-Production Checklist

Use this before deploying to production:

### Critical Items (Must Fix)
- [ ] All authentication endpoints use HTTPS
- [ ] No default passwords in use
- [ ] All secrets in secret management system
- [ ] Database not publicly accessible
- [ ] TLS 1.2+ enforced
- [ ] Network policies implemented
- [ ] No critical vulnerabilities in images
- [ ] Backup and restore tested
- [ ] Audit logging enabled
- [ ] RBAC properly configured

### High Priority (Should Fix)
- [ ] MFA enabled for admin accounts
- [ ] Secret rotation configured
- [ ] API rate limiting enabled
- [ ] WAF configured
- [ ] Container images scanned
- [ ] Pod Security Standards enforced
- [ ] Monitoring and alerting set up
- [ ] Incident response plan documented

### Medium Priority (Plan to Fix)
- [ ] Automated security testing
- [ ] Regular penetration testing
- [ ] Security training completed
- [ ] Compliance certifications
- [ ] Bug bounty program

Automated Security Scanning

## Run security scan suite
./scripts/security-audit.sh

security-audit.sh:

#!/bin/bash
set -e

echo "=== Running Security Audit ==="

## 1. Check for secrets in code
echo "Checking for hardcoded secrets..."
git secrets --scan || true

## 2. Scan dependencies
echo "Scanning Python dependencies..."
pip-audit

## 3. Scan container images
echo "Scanning container images..."
trivy image mcp-server-langgraph:latest

## 4. Check Kubernetes configuration
echo "Checking Kubernetes configs..."
kubectl kustomize overlays/production | kubesec scan -

## 5. Network policy check
echo "Verifying network policies..."
kubectl get networkpolicies -A

## 6. RBAC audit
echo "Auditing RBAC..."
kubectl auth can-i --list --as=system:serviceaccount:mcp-server-langgraph:mcp-server-langgraph

## 7. Check for exposed secrets
echo "Checking for exposed secrets..."
kubectl get secrets -A -o json | grep -i "password\|token\|key" || true

echo "=== Security Audit Complete ==="

Next Steps

Compliance Guide

GDPR, SOC2, HIPAA compliance

Best Practices

Security hardening guide

Security Overview

Security architecture overview

Quick Start Security

Essential security setup

Security Audit Complete: Systematic security review for production readiness!

Getting Started

Core Concepts

Framework Comparisons

Security

Local Development

Testing

Contributing

Workflows

Troubleshooting

Integrations

Diagrams

Overview

Authentication & Authorization

Keycloak Configuration

Secrets Management

Infrastructure Secrets

Network Security

Network Configuration

Application Security

Code Security

Container Security

Image Security

Data Protection

Data Security

Kubernetes Security

Cluster Security

Compliance & Governance

Compliance

Pre-Production Checklist

Automated Security Scanning

Next Steps

Compliance Guide

Best Practices

Security Overview

Quick Start Security

Getting Started

Core Concepts

Framework Comparisons

Security

Local Development

Testing

Contributing

Workflows

Troubleshooting

Integrations

Diagrams

​Overview

​Authentication & Authorization

​Keycloak Configuration

​Secrets Management

​Infrastructure Secrets

​Network Security

​Network Configuration

​Application Security

​Code Security

​Container Security

​Image Security

​Data Protection

​Data Security

​Kubernetes Security

​Cluster Security

​Compliance & Governance

​Compliance

​Pre-Production Checklist

​Automated Security Scanning

​Next Steps

Compliance Guide

Best Practices

Security Overview

Quick Start Security

Overview

Authentication & Authorization

Keycloak Configuration

Secrets Management

Infrastructure Secrets

Network Security

Network Configuration

Application Security

Code Security

Container Security

Image Security

Data Protection

Data Security

Kubernetes Security

Cluster Security

Compliance & Governance

Compliance

Pre-Production Checklist

Automated Security Scanning

Next Steps