How Aki MCP Server keeps access on your terms

A hard whitelist, not a blocklist

The shell tool only runs commands you explicitly approve. A blocklist is leaky because its default is allow; a whitelist fails safe.

• Fail-safe: an unfamiliar or new command is blocked automatically.
• Minimal surface: only the exact commands you approved can run.
• Granular to the subcommand: git is scoped to status/log/diff/show.
• Limits prompt injection: an injected instruction has no unlisted command to escalate to.
• Inspection-first: flag-rich binaries that could escape read-only are deliberately left out, and git write forms (branch -D, tag -d, remote set-url, --output=) are refused by default.

Design stance: convenience first, guardrail second. The allowlist guards against weak or overeager models. It is not a lock against you, the owner.

Authentication and authorization

• Every /mcp call needs a valid OAuth 2.1 Bearer token. There is no token-in-URL shortcut.
• Claude uses a pre-issued confidential Client ID/Secret; ChatGPT and Grok self-register via DCR (RFC 7591) as public clients.
• Only redirect URIs of known clients are accepted (claude.ai, chatgpt.com, grok.com and Google’s OAuth redirect proxy), and a client still must pass a passphrase consent screen and PKCE before it gets a token.
• One shared access token (valid for a year) serves every client, so the panel can show and roll it in one place.

Automatic lockout and a clear view

The gatekeeper rate limits failed attempts, and panel section 7 shows who holds access and who used it.

• 5 strikes, 15 minutes out: 5 rejected credentials in 60 seconds (wrong passphrase, wrong client secret, invalid Bearer on /mcp) block the caller for 15 minutes with a 429 and Retry-After.
• Registration flood guard: 100 POST /register calls in 10 minutes also block the caller, and the client list stops growing at 500.
• Real clients are safe: a valid Bearer token is never counted or refused, and protocol errors or unknown paths are never counted.
• You set the numbers: every limit is editable in panel section 7, which lists blocked callers with a Release button.
• See everything: Clients (first seen, last approval, last token grant, address and agent), Active now, and the newest 200 lines of security.log.
• Masked secrets: the passphrase and access token show as dots with an eye button, so a screenshot carries neither.

If a secret leaks

The panel turns the clean-up into a few clicks. Pick the row that matches what was exposed.

• Passphrase seen: Roll passphrase, then Roll & sign out all clients.
• Access token seen: Roll & sign out all clients.
• Unknown client in the list: both rolls, then reconnect the AIs you trust.
• A connector you no longer use: Remove, then Roll token.

What each layer protects

What the AI can and cannot do by default

Honest trade-offs you must know

• The default file root is your entire home folder ($HOME) plus ~/.aki and ~/.claude. Narrow it in the panel on a sensitive machine.
• ~/.claude is granted at the folder level, so session tokens and chat history inside it are also in reach. Remove it by editing the folders list directly.
• Any write command you add to the allowlist (for example git commit) is your own responsibility and widens the surface.
• With one shared token, Remove signs a client out but is not an instant revoke. Roll the token to cut access at once.
• The rate limiter lives in memory, so a restart clears the blocked list. Client names are self-declared, so trust the address and time columns more than the label.
• Gemini is experimental: the OAuth connection works but tool use is unreliable today.

Revoke access anytime from panel section 7: Remove a client, then Roll token. If a secret may have leaked, use Roll & sign out all clients.