Talon MCP Firewall · Security
Security
How Talon MCP Firewall protects the data that passes through it.
Architecture
- Static frontend, zero runtime dependencies. The page is plain HTML/CSS/JS; there is no third-party script on the page.
- Server-side secrets only. Any API keys live in server-side secrets. They never ship to the browser and are never exposed client-side.
- Same-origin keyless API. The frontend calls the API same-origin; cross-origin API consumers require a shared secret. Rate limiting (10 requests/minute/IP) protects the API.
Data handling
The demo's audit log is written locally on the machine running the gate. The public static site stores nothing and transmits no data.
Transport and headers
All traffic is HTTPS with TLS 1.2+. Every response carries security headers: HSTS, Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, and Cross-Origin isolation headers.
Third parties
No third-party processors are involved.
Disclosure
Security findings can be reported via /.well-known/security.txt on the service domain or by email to info@raptorlabs.dev.
Limitations (honest)
Talon MCP Firewall is a demonstration-grade tool, not a compliance product. It does not hold third-party compliance certifications, and its rate limiting relies on an eventually consistent platform store — treat it as a throttle, not a security boundary.