{ "title": "Secure MCP Reference Architectures", "schemaVersion": "1.0", "researchFreeze": "2026-08-26", "protocolRevision": "MCP 2026-07-28", "sourcePackage": "research/10", "integrityNote": "All 108 listed ordinary archive payloads verify. The package contains two incompatible numeric source namespaces; public records preserve an explicit archive namespace and never resolve IDs across families.", "evidencePolicy": "Only manually curated build_context source groups appear in sourceIds. Raw row tokens are preserved under archive and are not treated as publication citations.", "checkedAt": "2026-08-26", "count": 7, "records": [ { "Architecture": "Secure personal local server", "Components": "Desktop host; signed/pinned server package; stdio; narrow filesystem roots", "Required controls": "Trust prompt, read-only default, env allowlist, OS sandbox, per-call confirmation", "Observability": "Local structured log with optional export", "State placement": "Local files or explicit DB", "Use when": "One user and machine-bound data", "Source IDs": "S002 S011 S013 S039", "id": "R10-SECARCH001", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485", "S467", "S468", "S471", "S472", "S473", "S474", "S476", "S478", "S479", "S480", "S486", "S487", "S488" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/secure_reference_architectures.json", "row": 1, "sourceIds": [ "S002", "S011", "S013", "S039" ], "raw": { "Architecture": "Secure personal local server", "Components": "Desktop host; signed/pinned server package; stdio; narrow filesystem roots", "Required controls": "Trust prompt, read-only default, env allowlist, OS sandbox, per-call confirmation", "Observability": "Local structured log with optional export", "State placement": "Local files or explicit DB", "Use when": "One user and machine-bound data", "Source IDs": "S002 S011 S013 S039" } } }, { "Architecture": "Enterprise-managed local server", "Components": "Managed endpoint; signed MCPB; EDR/sandbox; central config", "Required controls": "Publisher allowlist, endpoint policy, secret broker, update ring", "Observability": "Central endpoint telemetry and server audit", "State placement": "Local machine plus enterprise backend", "Use when": "Machine access under enterprise control", "Source IDs": "S014 S015 S016 S040", "id": "R10-SECARCH002", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485", "S467", "S468", "S471", "S472", "S473", "S474", "S476", "S478", "S479", "S480", "S486", "S487", "S488" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/secure_reference_architectures.json", "row": 2, "sourceIds": [ "S014", "S015", "S016", "S040" ], "raw": { "Architecture": "Enterprise-managed local server", "Components": "Managed endpoint; signed MCPB; EDR/sandbox; central config", "Required controls": "Publisher allowlist, endpoint policy, secret broker, update ring", "Observability": "Central endpoint telemetry and server audit", "State placement": "Local machine plus enterprise backend", "Use when": "Machine access under enterprise control", "Source IDs": "S014 S015 S016 S040" } } }, { "Architecture": "Single-tenant remote server", "Components": "HTTPS ingress; container/function; one customer data plane", "Required controls": "OAuth/IAM, private networking, semantic auth, rate limits", "Observability": "Central logs/traces per tenant", "State placement": "Tenant DB/cache/handles", "Use when": "Regulated or high-isolation enterprise integration", "Source IDs": "S004 S056 S057", "id": "R10-SECARCH003", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485", "S467", "S468", "S471", "S472", "S473", "S474", "S476", "S478", "S479", "S480", "S486", "S487", "S488" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/secure_reference_architectures.json", "row": 3, "sourceIds": [ "S004", "S056", "S057" ], "raw": { "Architecture": "Single-tenant remote server", "Components": "HTTPS ingress; container/function; one customer data plane", "Required controls": "OAuth/IAM, private networking, semantic auth, rate limits", "Observability": "Central logs/traces per tenant", "State placement": "Tenant DB/cache/handles", "Use when": "Regulated or high-isolation enterprise integration", "Source IDs": "S004 S056 S057" } } }, { "Architecture": "Multi-tenant remote SaaS", "Components": "Gateway; stateless replicas; tenant-aware data; auth server", "Required controls": "Audience-bound token, tenant context, object checks, DLP, quotas", "Observability": "Per-user/tenant audit, alerts and SLOs", "State placement": "External DB/task store", "Use when": "Vendor-supported integration for many customers", "Source IDs": "S004 S007 S058 S059", "id": "R10-SECARCH004", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485", "S467", "S468", "S471", "S472", "S473", "S474", "S476", "S478", "S479", "S480", "S486", "S487", "S488" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/secure_reference_architectures.json", "row": 4, "sourceIds": [ "S004", "S007", "S058", "S059" ], "raw": { "Architecture": "Multi-tenant remote SaaS", "Components": "Gateway; stateless replicas; tenant-aware data; auth server", "Required controls": "Audience-bound token, tenant context, object checks, DLP, quotas", "Observability": "Per-user/tenant audit, alerts and SLOs", "State placement": "External DB/task store", "Use when": "Vendor-supported integration for many customers", "Source IDs": "S004 S007 S058 S059" } } }, { "Architecture": "Enterprise gateway", "Components": "MCP gateway; server catalog; remote targets; optional local policy plane", "Required controls": "SSO, allowlists, token exchange, egress policy, target ownership", "Observability": "End-to-end trace ID and tool-level audit", "State placement": "Gateway cache plus target state", "Use when": "Many teams/servers with central governance", "Source IDs": "S052 S053 S054 S055 S062", "id": "R10-SECARCH005", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485", "S467", "S468", "S471", "S472", "S473", "S474", "S476", "S478", "S479", "S480", "S486", "S487", "S488" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/secure_reference_architectures.json", "row": 5, "sourceIds": [ "S052", "S053", "S054", "S055", "S062" ], "raw": { "Architecture": "Enterprise gateway", "Components": "MCP gateway; server catalog; remote targets; optional local policy plane", "Required controls": "SSO, allowlists, token exchange, egress policy, target ownership", "Observability": "End-to-end trace ID and tool-level audit", "State placement": "Gateway cache plus target state", "Use when": "Many teams/servers with central governance", "Source IDs": "S052 S053 S054 S055 S062" } } }, { "Architecture": "Serverless stateless server", "Components": "Workers/Functions; one MCP endpoint; external state", "Required controls": "OAuth/IAM, Origin validation, request size/time limits", "Observability": "Platform logs and distributed traces", "State placement": "External DB/object store/explicit handles", "Use when": "Bursty tools and low-ops deployment", "Source IDs": "S003 S047 S048 S051 S057", "id": "R10-SECARCH006", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485", "S467", "S468", "S471", "S472", "S473", "S474", "S476", "S478", "S479", "S480", "S486", "S487", "S488" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/secure_reference_architectures.json", "row": 6, "sourceIds": [ "S003", "S047", "S048", "S051", "S057" ], "raw": { "Architecture": "Serverless stateless server", "Components": "Workers/Functions; one MCP endpoint; external state", "Required controls": "OAuth/IAM, Origin validation, request size/time limits", "Observability": "Platform logs and distributed traces", "State placement": "External DB/object store/explicit handles", "Use when": "Bursty tools and low-ops deployment", "Source IDs": "S003 S047 S048 S051 S057" } } }, { "Architecture": "Private tunnel endpoint", "Components": "Private server; outbound tunnel; cloud MCP host", "Required controls": "Tunnel auth, MCP auth, loopback/private binding, network policy", "Observability": "Tunnel + server + host audit correlation", "State placement": "Private/local application state", "Use when": "On-prem/private service without public inbound exposure", "Source IDs": "S035 S050", "id": "R10-SECARCH007", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485", "S467", "S468", "S471", "S472", "S473", "S474", "S476", "S478", "S479", "S480", "S486", "S487", "S488" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/secure_reference_architectures.json", "row": 7, "sourceIds": [ "S035", "S050" ], "raw": { "Architecture": "Private tunnel endpoint", "Components": "Private server; outbound tunnel; cloud MCP host", "Required controls": "Tunnel auth, MCP auth, loopback/private binding, network policy", "Observability": "Tunnel + server + host audit correlation", "State placement": "Private/local application state", "Use when": "On-prem/private service without public inbound exposure", "Source IDs": "S035 S050" } } } ] }