Security Considerations for Data, Files, and Network
mainWhen deploying or using the MCP Documentation Server, be aware of the following security boundaries:
Data Storage
- Documents are stored locally in
~/.mcp-documentation-server/. - No data is transmitted to external servers, except for initial embedding model downloads.
- Action: Ensure proper file system permissions are set on the storage directory.
File Upload Security
- Supported formats: Only
.txt,.md, and.pdffiles are processed. - PDF Processing: Uses the
unpdflibrary for safe text extraction without code execution. - Path Traversal: The server restricts file access to designated directories only.
- Action: Always validate the source and content of uploaded files before processing.
Network Security
- The server runs locally via
stdiotransport by default. - No network ports are opened unless explicitly configured.
- Communication is handled by the MCP client (e.g., Claude Desktop).
Embedding Models
- Models are downloaded from HuggingFace Hub on first use.
- Models run locally; data is not sent to external services during inference.
- Action: Verify model integrity if using custom embedding models.