Security & Rate Limits
Edge protection, multi-tiered rate limiters, token privacy, and boundary defenses in Kalpana MCP.
The Kalpana MCP gateway acts as an isolated security perimeter between public LLM clients and Kalpana's internal rendering microservices. It enforces strict rate limiting, cryptographic token privacy, payload quotas, and workspace boundary checks.
Multi-Tier Edge Rate Limiting
The Cloudflare Worker deployment utilizes five independent rate-limiting namespaces to isolate traffic and prevent resource starvation:
| Limiter Namespace | Target | Limit | Window | Key Strategy |
|---|---|---|---|---|
REGISTRATION_RATE_LIMITER | Dynamic Client Registration | 10 requests | 1 minute | Source IP address |
AUTHORIZATION_RATE_LIMITER | Authorization redirect & consent | 60 requests | 1 minute | Source IP address |
TOKEN_RATE_LIMITER | Token code exchange & refresh | 60 requests | 1 minute | Source IP address |
MCP_EDGE_RATE_LIMITER | All edge MCP traffic | 300 requests | 1 minute | Source IP address |
MCP_PROBE_RATE_LIMITER | Unauthorized probe requests | 20 requests | 1 minute | Source IP address |
MCP_RATE_LIMITER | Authenticated MCP tool calls | 120 requests | 1 minute | Opaque SHA-256 hashed bearer token |
Rate-Limit Privacy: Bearer tokens are never stored in plaintext or logged. The gateway computes an opaque SHA-256 hash to index authenticated rate-limit buckets.
Payload Size Restrictions
To defend against denial-of-service and memory exhaustion attacks, strict request size quotas are enforced at the network boundary:
- OAuth Requests (
/oauth/*): Max 16 KiB. Payloads exceeding this return413 Payload Too Large. - MCP Requests (
/mcp): Max 1 MiB. Ensures batch definitions and variable overrides stay within safe limits while preventing oversized JSON uploads. - Bearer Tokens: Max 4,096 bytes.
Gateway Isolation Secret
The gateway and the web application share a cryptographically secure random secret (MCP_REGISTRATION_SHARED_SECRET of 32+ characters).
- When the gateway proxies token exchange or dynamic registration requests to the web backend, it injects the header
x-mcp-gateway-secret. - The web backend explicitly rejects any registration or token exchange requests that lack this secret, preventing attackers from bypassing gateway rate limiters.
Cloudflare Bot Management & WAF
- CIMD (Preferred): ChatGPT's preferred Client ID Metadata Document flow eliminates automated dynamic registration challenges because verification happens via ChatGPT's published HTTPS documents.
- Dynamic Registration: If you enable dynamic registration on a zone using Cloudflare's Bot Fight Mode, automated clients may be challenged by Cloudflare's WAF before hitting the Worker. For production deployments with dynamic registration, use Cloudflare Super Bot Fight Mode with a narrow WAF skip rule targeting
POST /oauth/registeron themcp.kalpana.onehostname. Never exempt the entire hostname.