Security Architecture Overview
Protection on several layers
Neurova safeguards the system at multiple levels:
| Layer | Mechanism |
|---|---|
| Transport security | JWT Bearer token authentication |
| Access control | Role-based permissions (admin/user) |
| Entry defence | IP allow/deny lists, rate limiting, input inspection |
| Data masking | API keys, tokens and passwords replaced automatically |
| User isolation | Hard isolation via three ContextVar scopes (agent / system user / conversation user) |
| Agent isolation | Configurable sandbox isolation between agents |
| File protection | Sensitive file types and paths intercepted automatically |
| Trust domain | Traffic to LLM and model services inside the trust boundary is exempt from firewall limits |
L0: Entry guardianship
JWT authentication
Every API request must carry a valid JWT token:
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...IP access control
- IP allow/deny lists controlling access by source IP
- A global rate limit that absorbs abusive requests
- Input safety inspection: prompt injection, SQL injection, command injection, path traversal
MCP governance
The MCP integration layer is hardened by six P0 controls (P0-1 to P0-6):
- Router authorization (stdio restricted to admin)
- A shell rejection table plus a command allowlist
- The firewall converged into the call_tool main path
- Full-parameter scanning (scan_all) with graded fail-closed
- Firewall identity threaded per request (ContextVar)
- SSRF protection (url_guard: private, loopback and link-local ranges)
Three-way isolation
- Agent isolation (agent_id): data of different agents is fully separated
- System user isolation (neuser_id): data of different system users is separated
- Conversation user isolation (user_id): within one agent, data of different conversation users is separated
- Cross-agent sharing (shared=True): an opt-in mechanism for sharing data deliberately