mirror of
https://github.com/mcp-use/mcp-use.git
synced 2026-09-14 18:06:01 +08:00
Ikko Eltociear Ashimine
7c276a4ff2
* docs: add security policy * Revise security reporting guidelines and contact info Updated contact information for security reports and modified supported versions section. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> * Add security section to README Added a security section with a link to SECURITY.md. Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> --------- Signed-off-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com> Co-authored-by: Enrico Toniato <2827496+tonxxd@users.noreply.github.com>
36 lines
1.0 KiB
Markdown
36 lines
1.0 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in mcp-use, please report it responsibly.
|
|
|
|
**Do NOT open a public GitHub issue for security vulnerabilities.**
|
|
|
|
### How to Report
|
|
|
|
1. **GitHub Security Advisories**: Use [GitHub's private vulnerability reporting](https://github.com/mcp-use/mcp-use/security/advisories/new)
|
|
2. **Email**: security@manufact.com
|
|
|
|
### What to Include
|
|
|
|
- Description of the vulnerability
|
|
- Steps to reproduce
|
|
- Impact assessment
|
|
- Suggested fix (if any)
|
|
|
|
### Response Timeline
|
|
|
|
- **Acknowledgment**: Within 48 hours
|
|
- **Assessment**: Within 1 week
|
|
- **Fix**: Depends on severity
|
|
|
|
## Manufact Cloud Security
|
|
For anything related to Manufact Cloud please report any findings at security@manufact.com
|
|
|
|
## Security Best Practices for MCP Users
|
|
|
|
1. **Review server permissions** before connecting to any MCP server
|
|
2. **Use environment variables** for secrets — never hardcode them
|
|
3. **Limit server access** to only required tools and resources
|
|
4. **Keep dependencies updated** to patch known vulnerabilities
|