Security

How the Hub reaches your sites

The Hub never holds a WordPress admin password or an unscoped key. Each site issues the Hub its own scoped OAuth token through the Cowboy MCP plugin, with the access level the site’s admin picks on the consent screen.

Either side can revoke that token: the site from its Connected apps table in wp-admin, or you from the dashboard. Once revoked, the Hub stops working on that site at once. The token is never handed to an AI client.

Every call to a site goes through the site’s own plugin, so the plugin’s guardrails still apply on top of the Hub’s.

Encryption of tokens, keys and credentials

Every site token, server credential and OpenRouter key is sealed with envelope encryption (AES-256-GCM). Each workspace has its own data key, and data keys are wrapped by a master key that is kept outside the database. A copy of the database alone does not reveal them.

Sign-in tokens for AI clients and API keys for terminals are stored only as hashes. Data travels over HTTPS, and the SSH connections to your servers are encrypted.

Isolation between workspaces

Every table in the database has row-level security on. Tables that hold secrets or service data are closed to the dashboard’s users entirely and reached only by the Hub’s own services. Every query is scoped to one workspace.

Server access

SSH or SFTP access to a site’s server is optional and added per site, only if you add it. Plain FTP is never accepted. A key or password, once added, is sealed and never shown back. You can delete it in the dashboard, and it stops working the moment you remove the key or change the password on your host.

When the Hub connects from fixed IP addresses, each site’s Server access page lists them, so your host can allow only them.

Before the Hub changes or deletes a file over server access, it copies the file to encrypted Hub storage in the US. The copy is kept for 30 days, so a restore still works if the server directory is gone.

Policies and approvals

Each site has one of three policies:

• Ask first (the default): reads run; every call that is not read-only waits in the approval inbox until an owner or admin approves it.
• Allow all: calls run without a ticket. Choosing it needs a confirmation, and the site carries a permanent badge. The audit trail and restore copies still apply.
• Read only: only reads run.

Every change to a site’s Cowboy MCP settings (safe mode, Power mode, the undo journal, the dry-run default) is a ticket, whatever the policy. Approvals show the exact call and a dry-run preview where the tool supports one.

Over server access, only a fixed allowlist of read-only commands (such as ls, cat, grep, and wp with its list, get and info subcommands) runs without a ticket. The full list is on each site’s Server access page. Every other command follows the site’s policy.

Audit on both sides

Every call and every server command is written to the Hub’s activity timeline, with the member or channel behind it, the site, the tool or command, and the result. It is kept for 90 days. Calls that go through the plugin are also in the site’s own Cowboy MCP log.

Secrets in arguments are redacted in the timeline, the same way the plugin redacts them. Secrets read from wp-config.php are redacted from agent conversations and from the audit trail.

The messaging agent

Every Telegram user, Slack user and email address the agent answers is linked to a workspace member with a one-time code. Messages from anyone else are ignored. Email is accepted only when it passes SPF and DKIM. Approvals by email go through a link to the dashboard, never by a reply. The agent calls models with your own OpenRouter key and the model you choose.

Where data lives

The database, the Hub’s services and the restore copies are in the US, in Northern California. The services the Hub uses are listed in the Privacy Policy.

Certifications

We do not have SOC 2 or a similar certification, and we do not plan one in the first year. This page describes what we do instead. We answer reasonable security questionnaires on request.

Reporting a vulnerability

If you find a security problem in the Hub, email security@cowboymcp.com [confirm address]. Please give us time to fix it before you make it public, and do not test against sites or workspaces that are not yours. We reply within [3] working days.