TwinMCP, a hosting platform for MCP servers. This post explains the safety choices we made, including the ones we haven't solved yet. Criticism welcome.

With MCP, ChatGPT, Claude or Cursor stop being chatbots. They read your Slack, write to your Notion, query your database, list your Stripe invoices. The risk moves from what the model says to what the model does.

So when we built a platform that hosts MCP servers for other people, "AI safety" stopped being an abstract debate for us. It became a list of very concrete questions: what can this agent touch, with which credentials, and how would we know if something went wrong?

Here is how we answer them today.

  1. Least privilege, enforced outside the model Never rely on the model to "be careful". Every MCP installed on TwinMCP has a tool access policy, enforced by our proxy rather than by the model:

All tools, read-only, or an explicit allow-list, and a deny list always wins.
Hidden tools are stripped from tools/list, so the model never even sees them. A tools/call to a disallowed tool is refused before it reaches the MCP.
Read-only mode fails closed: a tool that doesn't declare itself read-only is treated as not read-only.
You can tick "Start read-only" when you install an MCP, and widen access later.

  1. Contain the blast radius
    Each server runs in its own isolated sandbox (a micro-VM), separated from your other servers and from other users. MCPs that turn a sandbox into a general-purpose computer (a shell, a code interpreter, a scripted browser) are not available on the free credit: they wait for a funded account.

  2. Credentials that can't do more than their job
    Secrets (API tokens, connection strings) are encrypted with AES-256-GCM, with a fresh IV on every write. The key lives outside the database.
    Scoped API keys: a key made for a client can only call the MCPs of one server. It can never manage your account.
    OAuth 2.1 for Claude and ChatGPT connectors: no key to paste. You sign in, pick on a consent screen which server the app may reach, and revoke it any time.
    Tokens are stored as SHA-256 hashes.
    Access tokens expire after an hour.
    Refresh tokens rotate on every use, and reusing an old one revokes the whole chain.

  3. Supply chain: no surprise updates
    Every MCP in our catalogue runs a pinned version, so a compromised or broken npm release can't roll into your sandbox on its own. Where an MCP offers safer modes, we turn them on by default (Supabase in --read-only, Postgres in restricted access mode).

  4. See every action, store as little as possible
    An activity log records every tool call: time, MCP, tool, status, latency, and which key or OAuth app made it. It stores metadata only: arguments and results are never stored. You get accountability without keeping your data.

  5. No runaway agents on your card
    Usage is prepaid and stops at zero, and calls are rate-limited. An agent stuck in a loop hits a wall, not your bank account.

What we have NOT solved (and nobody fully has)
Prompt injection. A web page, an e-mail or a ticket can contain instructions aimed at your agent. Our policies limit what a hijacked agent can do, but no platform can guarantee the model won't follow a malicious instruction. Keep human approval on destructive actions in your client.
Tool annotations are hints. "Read-only" is declared by the MCP's author. That's why we fail closed, and why the allow-list exists.
Compliance. We don't hold SOC 2 or ISO 27001 yet, we offer no uptime SLA, and you can't choose a data region yet. We'd rather say it than imply otherwise.
A checklist you can apply anywhere, with or without us
Start every new MCP read-only and widen access tool by tool.
Give each client its own narrowly scoped token, and revoke what you don't use.
Isolate MCPs from your laptop and from each other.
Pin versions; don't let npx -y latest decide what runs.
Log every tool call, and look at the log once in a while.
If you want to try this setup, TwinMCP hosts 70+ MCPs (or your own npm/PyPI package) behind one URL for ChatGPT, Claude, Cursor and VS Code. New accounts get €10 of free credit, no card: twinmcp.fr.

But I'm mostly curious: how do you handle agent permissions today? What would you want a platform like ours to enforce that we don't yet?