MCP-Project-bus/docs/THREAT_MODEL.md

Threat Model

Assets

• project instructions, decisions, results, reviews, and escalations;
• actor-role assignments and identity bindings;
• event ordering and audit integrity;
• bearer credentials;
• commit, artifact, and baseline references;
• service/database availability.

Adversaries

• an unauthenticated network client;
• an authenticated actor exceeding their formal mandate;
• an implementer attempting self-review or self-acceptance;
• a compromised bearer token;
• a malicious artifact URI or oversized request;
• an operator or database account attempting audit-history mutation;
• concurrent clients exploiting check/write races.

Implemented controls

Threat	MVP control
Identity spoofing in tool args	no actor argument; identity comes from transport
Token timing comparison	SHA-256 digest and constant-time comparison
Unauthorized project access	active membership lookup per call
PA decision overreach	explicit decision/gate/baseline denial
Product decision overreach	PO-only product decisions
Self-review	reviewer role plus actor independence checks
Self-acceptance	PM/PO role and result-submitter identity check
Premature gate acceptance	independent APPROVE review required
Double claim / TOCTOU	BEGIN IMMEDIATE and conditional state update
Duplicate delivery	scoped request hash and idempotency record
Audit update/delete	SQLite triggers reject both operations
Cross-project reads	project filter plus membership resolution
Browser cross-origin request	exact configurable Origin allowlist
Oversized request	one MiB body limit
MIME confusion/caching	strict JSON input, nosniff, no-store
SQL injection	parameterized SQL; one controlled placeholder expansion

Artifact URIs and review evidence are recorded as untrusted data and are never fetched or executed by the bus.

Residual risks and production requirements

1. Static bearer credentials have no built-in expiry, rotation endpoint, audience, issuer, or proof-of-possession. Replace the adapter with validated OIDC/JWT or mTLS identities.
2. Plain HTTP is available. Use TLS and prohibit direct public access to the application port.
3. SQLite append-only triggers do not protect against an operator replacing the entire database file or disabling triggers. Use restricted DB roles, PostgreSQL permissions, PITR, backups, and an external immutable audit export for production assurance.
4. The event payload is not cryptographically chained or signed. Add hash chaining/signatures only if the agreed threat model requires tamper evidence against privileged database operators.
5. No application rate limiter exists. Apply per-identity limits and request quotas at the trusted edge.
6. The server emits access metadata but no security audit sink or metrics. Integrate structured logs, alerts, and privacy-aware retention.
7. Membership deactivation and credential revocation are not exposed as MVP tools. Operators must treat compromised tokens as an immediate configuration/restart incident.
8. Role assignment is one role per actor/project. Shared human/agent accounts undermine independence even when IDs differ and are prohibited operationally.
9. Evidence and artifact digests are caller assertions; the bus does not verify repository ownership or retrieve content.
10. Dependency-free MCP handling reduces supply-chain surface but has not yet been interoperability-tested against every intended client version.

Security verification before activation

• run all tests and an independent code review;
• test the exact Claude Code and ChatGPT MCP clients;
• replace all example tokens and restrict origin/host exposure;
• confirm backup/restore and audit export;
• review log contents for sensitive project data;
• add abuse limits and operational monitoring;
• decide whether privileged-operator tamper evidence is required.