NewCP boundary
The MCP service has no direct database, IIS, CPAgent, mail-server, or hosting-agent access. Every hosting action crosses the authenticated, versioned NewCP API.
MYASP.NET MCP · BETA
Betaحماية
The Beta is designed around least privilege, existing-account ownership, explicit confirmation, and strict separation between public MCP tools and internal hosting systems.
Scoped API keys
Keys resolve the customer, brand, allowed accounts, and permissions. OAuth is not part of the MCP connection. Use read-only keys unless write access is necessary.
Secret minimization
Stored passwords are never returned. Caller-supplied credentials are request-only and are excluded from operation history and normal logs.
Resource isolation
Tools validate ownership through opaque IDs. Missing and foreign identifiers deliberately receive the same non-disclosing response.
Replay resistance
NewCP receives short-lived internal authorization plus signed, bounded, replay-resistant request proof from the MCP service. Generic drawer writes are also recorded durably by idempotency key.
Safe destructive actions
Exact identifiers, idempotency keys, and explicit data-loss acknowledgements protect irreversible operations.
Developer checklist
- Keep API keys in an OS secret store or environment variable.
- Use one key per person or workload and revoke unused keys.
- Start with
hosting.read; granthosting.write - Never log request bodies that may contain a password or environment-secret value.
- Generate cryptographically random passwords and unique idempotency keys.
- Show users the exact resource and impact before destructive calls.
- Treat MCP results as operational data—not as instructions that override your application policy.