Security model

Security responsibilities are distributed across the MCP client, MarkLogic MCP Server, and MarkLogic Server. The MCP client authenticates the user and sends authorization information, MarkLogic MCP Server handles that information according to the configured authentication mode, and MarkLogic Server enforces access to endpoints and documents.

Security responsibilities

MCP client

The MCP client is responsible for these tasks:

• Obtain or store the authorization information required to call MarkLogic MCP Server.
• Send either an OAuth access token or base64-encoded MarkLogic Server credentials in an Authorization header.

MarkLogic MCP Server

MarkLogic MCP Server is responsible for these tasks:

• Receive authorization information from the MCP client.
• Handle OAuth metadata and redirect behavior when OAuth is configured.
• Validate the tool request before forwarding it.
• Convert incoming authorization information into the form required by MarkLogic Server.
• Forward the request with the caller's identity or credentials.

MarkLogic MCP Server does not grant access to MarkLogic Server content. MarkLogic Server makes the authorization decision.

MarkLogic Server

MarkLogic Server is responsible for these tasks:

• Authenticate the identity or credentials forwarded by MarkLogic MCP Server.
• Check the user's roles.
• Enforce endpoint privileges and document permissions.
• Execute authorized search and retrieval operations.
• Rejecting requests for which the user lacks the required permissions.

Authentication modes

MarkLogic MCP Server supports basic, digest, and OAuth authentication modes. The configured mode determines what the MCP client sends and how MarkLogic MCP Server authenticates with MarkLogic Server.

Basic and digest flow

1. The MCP client sends a bearer value containing base64-encoded username:password credentials.
2. MarkLogic MCP Server decodes the value.
3. MarkLogic MCP Server uses the credentials to authenticate the MRA request with MarkLogic Server by using the configured basic or digest method.
4. MarkLogic Server authenticates the user and enforces the user's permissions.

Because this bearer value contains credential material, use it over HTTP only in a trusted local environment. Use HTTPS for remote connections.

Use TLS to protect data in transit.

OAuth flow

1. The MCP client obtains an access token from the configured identity provider.
2. The MCP client sends the token to MarkLogic MCP Server in an Authorization: Bearer <access-token> header.
3. MarkLogic MCP Server forwards the token to MarkLogic Server for each MRA request.
4. MarkLogic Server authenticates the token and enforces the authenticated user's permissions.

If the MCP client does not provide a bearer token, then MarkLogic MCP Server can direct a conforming MCP client to the configured MarkLogic Server OAuth authorization flow.

Trust boundaries

A trust boundary identifies where requests, responses, or credentials move between components which have different security responsibilities.

Between the MCP client and MarkLogic MCP Server

The MCP client sends tool requests and authorization information to MarkLogic MCP Server. These actions protect this boundary:

• Use HTTPS outside trusted local development.
• Validate the MarkLogic MCP Server certificate.
• Restrict access to the MCP Server endpoint.
• Protect tokens or credentials stored by the MCP client.

MarkLogic MCP Server can read the authorization information that it receives. Deploy MarkLogic MCP Server in an environment controlled by or trusted by your organization.

Between MarkLogic MCP Server and MarkLogic Server

MarkLogic MCP Server sends MRA requests and receives MarkLogic Server data across this boundary. These actions protect this boundary:

• Use HTTPS.
• Validate the MarkLogic Server certificate.
• Limit network access to the MarkLogic REST app server.
• Ensure that the configured authentication mode matches the MarkLogic Server configuration.

MarkLogic Server independently enforces roles, privileges, and document permissions for forwarded requests.

Between the MCP client and the identity provider

When OAuth is configured, the MCP client communicates with the identity provider to authenticate the user and obtain tokens. These actions protect this boundary:

• Use HTTPS and valid certificates.
• Ensure that redirect URIs and the advertised identity-provider URL are correct.
• Protect cached tokens on the client system.
• Revoke compromised tokens through the identity provider.

Credential handling

This table shows the credentials that need to be secured, which component handles them, and what each one does:

Do not store credentials, tokens, client secrets, or certificate material in source control. Follow your organization's credential storage and rotation policies.

Request validation and XPath safeguards

MRA validates XPath expressions against a security blocklist before execution. The blocklist prevents expressions from invoking categories of functions that can execute code, access the file system, or perform administrative operations.

Configured XPath expressions are also validated when retrieval configuration is loaded. This validation helps identify an unsafe configuration before a request uses it.

XPath validation supplements MarkLogic Server permissions. It does not replace authentication, role-based access control, document permissions, or transport security.

MarkLogic Server access control

MarkLogic Server controls access through users, roles, privileges, and document permissions. A user can retrieve only content for which the user's roles grant the required capability.

MRA deployment includes roles such as mra-reader. Application-specific roles can grant access to particular content or collections. Assign only the roles required for the user's work.

Labels and search constraints narrow the candidate result set, but they do not replace document permissions. MarkLogic Server continues to enforce permissions on the documents considered and returned by a query.

Protect data in transit

Use TLS for communication across component and network boundaries:

• MCP client to MarkLogic MCP Server.
• MarkLogic MCP Server to the MarkLogic REST app server.
• MCP client to the identity provider when OAuth is configured.

Use certificates issued by a trusted certificate authority for production deployments.

Do not disable certificate validation in production.

Operational security guidance

Before exposing MarkLogic MCP Server beyond local development, do these tasks:

• Restrict network access to MarkLogic MCP Server and MarkLogic Server endpoints.
• Store secrets outside the repository.
• Use least-privilege MarkLogic Server roles and OAuth client permissions.
• Review logs to ensure that tokens and passwords are not recorded.
• Monitor authentication failures and unexpected request patterns.
• Document procedures for credential rotation, token revocation, certificate renewal, and server isolation.

For deployment guidance and operational checks, see Configure MarkLogic MCP Server and Configure an MCP Client.