Building a Secure Enterprise MCP Server with a Dual Architecture

Forceweaver is an enterprise-grade MCP (Model Context Protocol) server designed to provide AI agents with secure health-checking tools for Salesforce Revenue Cloud. While MCP enables powerful integration between AI agents and external services, this capability introduces significant security risks. This document outlines how Forceweaver was built to address these threats using a dual-architecture design that protects intellectual property while ensuring enterprise-grade security.

The security implementation is based on the official MCP Security Best Practices specification and research from firms like Trail of Bits and Microsoft Defender for Cloud.

The Dual-Architecture Solution

Forceweaver uses a dual-architecture strategy to separate the public-facing server from the private backend infrastructure. This design balances open integration with security and IP protection.

• Public MCP Server: A lightweight, open-source proxy server distributed via PyPI.
• It handles all MCP protocol communication.
• It contains no proprietary business logic or sensitive algorithms.
• Its open-source nature allows for full security auditing.
• Private Backend Infrastructure: A secure core running on Heroku.
• It contains all api, management, proprietary algorithms, user management, and billing systems.
• This protects core intellectual property by keeping it off the client (server).
• It allows for applying enterprise-grade security controls and monitoring.

Secure Communication Flow

The system uses a three-tier communication model to ensure security at each step.

• Tier 1: AI Agent to MCP Server: AI agents like GitHub Copilot or Claude Desktop communicate with the local MCP Server. This communication uses JSON-RPC 2.0 over STDIO, ensuring low latency and eliminating network dependencies for protocol handling.
• Tier 2: MCP Server to Backend: The MCP Server makes HTTPS REST API calls to the Forceweaver backend. All communication is secured with TLS 1.3.
• Tier 3: Backend to Salesforce: The backend uses OAuth 2.0 with PKCE to securely access Salesforce APIs. Sensitive credentials are encrypted at rest with AES-256 and are never persisted in plain text.

Security Implementation: Mitigating MCP Threats

Forceweaver implements a Defense-in-Depth security model to address all major threats identified in the MCP specification.

Confused Deputy Attack Prevention

This attack occurs when an MCP server is tricked into misusing its authority. Our prevention strategy includes:

• Strict Redirect URI Validation: All redirect URIs are validated against an approved whitelist of domains, including localhost, claude.ai, and vscode.dev.
• Explicit User Consent: The server requires explicit user consent for each dynamically registered client, preventing attackers from using static client IDs to bypass consent mechanisms.

# app/mcp_security_compliance.py snippet
def prevent_confused_deputy(self, client_id: str, redirect_uri: str, user_consent: bool = False) -> bool:
    """
    Prevent Confused Deputy attacks in OAuth flows
    """
    # Validate redirect URI against whitelist
    if not self.validate_redirect_uri(redirect_uri):
        return False

    # Require explicit user consent
    if not user_consent:
        logger.error(f"Confused Deputy prevention: missing user consent")
        return False

    return True

Token Passthrough Prevention

This vulnerability involves an MCP server accepting tokens not specifically issued for it. Our prevention strategy includes:

• Token Audience Validation: The server validates that every token was explicitly issued for the forceweaver-mcp audience.
• Strict Token Format: The system rejects any tokens that do not match the expected Forceweaver format (a fk_* prefix). This prevents malicious token reuse from other services.

# app/mcp_security_compliance.py snippet
def validate_token_audience(self, token: str, expected_audience: str = "forceweaver-mcp") -> bool:
    """
    Validate that token was issued TO this MCP server
    """
    # Check Forceweaver token format
    if re.match(self.FORCEWEAVER_TOKEN_PATTERN, token):
        return True

    # Reject any other token formats
    logger.error("Token validation failed: invalid token format for MCP server")
    return False

Session Hijacking Prevention

This threat involves an attacker gaining unauthorized access to a user’s session. Our prevention strategy includes:

• User-Bound Sessions: Each session ID is cryptographically tied to a specific user ID. The server validates this binding on every inbound request.
• Secure Session Management: Sessions use secure random generation, have automatic expiration (1-hour default), and are cleared upon termination.

Comprehensive Input Validation and Sanitization

All inputs undergo strict validation to prevent injection and denial-of-service attacks.

• Request structure validation against expected schemas.
• Parameter sanitization to prevent SQL injection and XSS attacks.
• Strict length limits (e.g., max 1000 characters) on inputs.
• Whitelisting of allowed check types, such as bundle_analysis and sharing_model.

Core Features and Tools

The Forceweaver MCP server provides AI agents with tools for professional Salesforce Revenue Cloud health checking.

• revenue_cloud_health_check: Performs a comprehensive analysis of org setup, sharing models, bundle hierarchy, and data integrity.
• get_detailed_bundle_analysis: Provides in-depth statistics on bundle components, detects circular dependencies, and assesses performance impact.
• list_available_orgs: Lists all Salesforce organizations connected to your Forceweaver account.
• get_usage_summary: Retrieves current API usage statistics and subscription status.

Integration and Configuration

The client is designed for easy integration with leading AI agent platforms.

Installation

pip install forceweaver-mcp-server

Configuration for VS Code + GitHub Copilot

Update .vscode/mcp.json with the server command and environment variables. The API key and Org ID are passed as parameters to the tools.

{
  "servers": {
    "forceweaver": {
      "type": "stdio",
      "command": "python3",
      "args": ["-m", "src"],
      "env": {
        "FORCEWEAVER_API_URL": "https://mcp.forceweaver.com",
        "FORCEWEAVER_API_KEY": "YOUR_API_KEY_HERE",
        "SALESFORCE_ORG_ID": "ORG_ID_HERE"
      }
    }
  }
}

Configuration for Claude Desktop

Update ~/.config/claude/claude_desktop_config.json. Note that API keys and org IDs are passed as tool parameters, not environment variables.

{
  "mcpServers": {
    "forceweaver": {
      "command": "python3",
      "args": ["-m", "src"],
      "env": {
        "FORCEWEAVER_API_URL": "https://mcp.forceweaver.com"
      }
    }
  }
}

Conclusion

The Model Context Protocol requires rigorous security design. The Forceweaver implementation shows that a dual-architecture model can provide a secure, scalable, and commercially viable MCP server. By integrating security from the initial design phase and addressing all specified threats, it is possible to build AI integrations that enterprises can trust.

• Security cannot be retrofitted: It must be a core part of the initial design.
• Transparency builds trust: An open-source client allows for community auditing while the private backend protects proprietary logic.
• Monitoring is essential: Real-time security event logging and automated response are mandatory for production systems.

For complete documentation and to get started, visit the Forceweaver Doumentation.

The mcp server is a available on my public repo at github. https://github.com/arohitu/forceweaver-mcp-server

References: Build an MCP Server Use MCP servers in VS Code MCP Architecture