Security & Threat Model

Intended Trust Model

Cloud Harness MCP is intentionally a private, single-owner remote coding harness. It allows arbitrary repository-controlled execution inside a constrained executor, but it is not a hostile multi-tenant sandbox.

Defensive Layers

1. Ingress & Control Plane Isolation

• The Ingress Proxy is the only service bound to external loopback.
• The API and Runner never publish host ports directly.
• The API has no access to the Docker socket or host filesystem mounts.

2. Executor Confinement & Hardening

• Non-Root User: Containers execute as UID 10001 (harness).
• Hardened Standard Mode: Standard executors strictly maintain --read-only, --cap-drop ALL, and --security-opt no-new-privileges.
• 3-Zone Storage Partitioning: Ephemeral secrets/config in RAM tmpfs (/tmp/cloud-harness-home), persistent user-space toolchains in /opt/user-tools & /var/cache/harness, and clean Git checkout in /workspace.
• No Docker Authority: No socket mount or host filesystem access.
• Network Egress On by Default (dependency-access): Workspace executors have outbound network access by default, so a workspace can reach the GitHub API and the bundled gh CLI. dependency-access permits only public DNS and TCP 80/443 while an attested Linux host firewall blocks loopback-to-host, Docker/control-plane, RFC 1918, link-local, and cloud-metadata ranges. It fails closed if attestation is unavailable and still permits public exfiltration. network-none blocks all egress and is the per-workspace or instance-wide opt-out.

3. Privileged Execution & Operator Grants

• Privileged (sudo/root) commands are treated as an explicit threat model weakening and are supported in Cloudflare Access mode only.
• Running with privileged: true requires an operator approval grant (PRIVILEGE_APPROVAL_REQUIRED), single-use, 60s TTL, bound to command and working directory hash.
• Approval is performed by authenticated operators via the Dashboard control plane (/api/v1/privilege-grants). MCP clients cannot self-approve.
• Approved privileged commands run in isolated ephemeral containers with root cleanup normalizers.

4. Credential Safety

• Private clone, push, and GitHub CLI operations use short-lived GitHub App tokens passed exclusively over stdin into ephemeral helpers.
• When no GitHub App token is available, an operator-supplied GH_TOKEN/GITHUB_TOKEN fallback is used instead: the runner environment credential (owner-bearer mode only), then the requesting principal's global runtime secret. The fallback is also passed only over stdin.
• Tokens are never stored in configuration files, MCP results, audit payloads, or repository commit history. The one documented exception is an operator-created GitHub runtime secret, which is deliberately injected into executor environments to authenticate the workspace gh CLI. Because egress is the default posture, repository-controlled code can exfiltrate such a credential; prefer a fine-grained token scoped to the repositories the workspace needs, or keep the instance or workspace on network-none.

5. Secrets Management & Ingest-Time Redaction

• Write-Only At Rest: Global and project environment secrets are encrypted at rest with AES-256-GCM via the runner-held keyring (SECRET_KEYRING_FILE). Secret values and ciphertext are never returned over MCP or dashboard APIs.
• Scope Precedence: Active global runtime secrets are automatically inherited by remote Docker workspaces; runtime environment secrets override colliding global keys when explicitly injected with confirmEnvironmentInjection: true.
• Stream & Output Redactor: Streaming task, shell, and session stdout/stderr chunks are sanitized across stream boundaries to [REDACTED_SECRET: <NAME>] before retained buffering, while synchronous exec_run command outputs and error messages are sanitized after capture before return.

6. Toolkit Provisioning Firewall & Content-Addressed Storage

• Internal Network Containment: All toolkit clone helpers run attached strictly to an internal: true network with no default gateway. Raw TCP sockets fail at the kernel level (ENETUNREACH).
• Dual-Homed Provisioning Proxy: All helper outbound traffic traverses provisioning-proxy:3128, enforcing DNS allowlists for approved Git hosts and blocking private subnets, loopback, and cloud metadata (169.254.169.254).
• Content-Addressed Storage (CAS): Pinned bundles are verified with full-tree SHA-256 digests and published atomically with fsync ordering to TOOLKIT_CACHE_ROOT.

7. Skill Tiers & Execution Isolation

• Built-in & Owner Tiers (/opt/cloud-harness/skills:ro, /opt/cloud-harness/owner-skills:ro): Mounted read-only (:ro) at the container engine boundary, preventing in-container modification.
• Workspace & Repository Tiers (/workspace/.cloud-harness/skills, /workspace/.agents/skills): Reside within the mutable repository checkout. Execution creates a snapshot under /tmp/cloud-harness-exec/<runId> and validates the full-tree bundle digest before execution to detect unintentional filesystem race conditions.