fleet-mcp

The server itself employs good security practices, including explicit read-only modes, SELECT-only query validation in read-only mode, careful handling of secrets, and explicit disabling of dangerous operations (e.g., wipe device, delete user). The primary security concern stems from the power of the underlying Fleet DM API: if the configured API token is compromised, an attacker could leverage the MCP server to perform actions on managed devices or extract sensitive data, even with internal validations. Proper API token management and secure deployment environment are crucial. Script execution and arbitrary query capabilities, while core to Fleet DM, represent significant power that must be guarded.