This guide outlines security best practices for configuring and using Model Context Protocol (MCP) servers with Kiro, helping you protect sensitive information and maintain system security.
MCP servers extend Kiro's capabilities by connecting to external services and APIs. Since all MCP servers are third-party code, this introduces potential security considerations that should be addressed:
Instead of hardcoding tokens in your configuration:
{ "mcpServers": { "github": { "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}" } } } }
Set the environment variable in your shell:
export GITHUB_TOKEN=your-token-value
For security, Kiro only expands environment variables that are explicitly approved. Only variables in the approved list will be expanded when found in MCP config files.
When you add or modify an MCP server configuration that includes unapproved environment variables, Kiro displays a security warning popup listing the variables that need approval. You can approve them directly from the popup or manage them in settings.
To manage approved environment variables:
This prevents MCP servers from accessing arbitrary environment variables on your system.
Restrict access to your MCP configuration files:
# Set restrictive permissions on user-level config chmod 600 ~/.kiro/settings/mcp.json # Set restrictive permissions on workspace-level config chmod 600 .kiro/settings/mcp.json
Only auto-approve tools that:
{ "mcpServers": { "aws-docs": { "autoApprove": [ "mcp_aws_docs_search_documentation", "mcp_aws_docs_read_documentation" ] } } }
Use workspace-level configurations for project-specific MCP servers:
project-a/ ├── .kiro/ │ └── settings/ │ └── mcp.json # Project A specific servers project-b/ ├── .kiro/ │ └── settings/ │ └── mcp.json # Project B specific servers
This ensures that:
Regularly review MCP logs to monitor server activity:
Periodically review which tools you've approved:
If you suspect a security issue with an MCP server:
Best practices