Security architecture

Security built into the gateway

Switchboard sits between your agents and your most sensitive systems. Here is exactly how we protect credentials, isolate tenants, and prove who can touch what, and how you can verify it yourself.

Report a vulnerability Read the source

Encrypted credential vault

AES-256-GCM, per org

Every integration credential and OAuth token is encrypted before it is written to the database. Ciphertext is versioned, and you can rotate or revoke any credential at any time.

Least-privilege policies

Glob + CEL, deny wins

Policies decide which member's agent can reach which system and which tools. Deny rules beat every grant, and the server re-checks every decision on every request.

Audit log

Every mutation

Member changes, policy edits, key creation, integration config, and tool calls are recorded with actor, action, and timestamp. Retention scales with your plan up to a full year.

Per-org isolation

Tenant scoped

Every request is scoped to an organization, with org checks on every read and write, so one tenant can never see another's credentials, policies, members, or audit history.

OAuth 2.0 and scoped API keys

PKCE · sb_ keys

Clients sign in through OAuth with Dynamic Client Registration and PKCE, or use sb_ API keys that are SHA-256 hashed at rest and revoked automatically when a member is offboarded.

Private-data tunnel

Outbound only

To reach data behind your firewall, you run a tunnel agent that dials out. No inbound ports, credentials stay in your environment, and read-only access is enforced on your side.

Request flow

What happens on every tool call

Each MCP request passes the same checks before it touches one of your systems.

Client

Cursor, Claude Code, Codex, or any MCP client calls your org's endpoint.

Authenticate

OAuth session or sb_ API key, verified against your org membership.

Authorize

Plan limits, then the member's resolved policies decide which tools exist.

Inject credentials

Only that org's decrypted config reaches the runtime, which has no database access.

Execute and audit

The tool runs, the response is compacted, and the call is recorded.

Defense in depth

Hardened at every layer

Beyond the gateway itself, the hosted service ships with the controls you would expect from infrastructure that holds credentials.

  • Hardened HTTP responses. Strict Transport Security, a Content Security Policy, X-Content-Type-Options, X-Frame-Options, and locked-down Referrer and Permissions policies.
  • CSRF protection. State-changing requests use a double-submit token; authenticated pages are served no-store so stale HTML never reappears after sign-out or an org switch.
  • Rate limiting. Sign-in, sign-up, API, and MCP endpoints are throttled to blunt brute force and abuse.
  • Least-privilege runtime. The MCP runtime has no database access. The control plane pushes only the config a given org needs over an internally authenticated channel.
  • No self-service escalation. Plan changes flow through billing, and role changes are validated against an allowlist.

Verify it yourself

Switchboard's core is source-available under the Elastic License 2.0. Read every line that touches your credentials and data, or self-host the open build so keys and data never leave infrastructure you control.

Source-available core

Responsible disclosure

Found a vulnerability? We take reports seriously and respond quickly. Please give us a reasonable window to remediate before public disclosure.

security@switchboard-mcp.com

Governance built in, not bolted on

Policies, audit, encryption, and isolation ship on every plan. You don't buy them back later.

Start free See pricing