acuvity/mcp-server-alibaba-cloud-ops repository overview

• Isolated Execution: All tools run within secure, containerized sandboxes to enforce process isolation and prevent lateral movement.
• Non-root by Default: Enforces least-privilege principles, minimizing the impact of potential security breaches.
• Read-only Filesystem: Ensures runtime immutability, preventing unauthorized modification.
• Version Pinning: Guarantees consistency and reproducibility across deployments by locking tool and dependency versions.
• CVE Scanning: Continuously scans images for known vulnerabilities using Docker Scout⁠ to support proactive mitigation.
• SBOM & Provenance: Delivers full supply chain transparency by embedding metadata and traceable build information."

Minibridge Integration: Minibridge⁠ establishes secure Agent-to-MCP connectivity, supports Rego/HTTP-based policy enforcement 🕵️, and simplifies orchestration.

The ARC⁠ container includes a built-in Rego policy⁠ that enables a set of runtime "guardrails"" to help enforce security, privacy, and correct usage of your services. Below is an overview of each guardrail provided.

⁠🔒 Resource Integrity

Mitigates MCP Rug Pull Attacks

• Goal: Protect users from malicious tool description changes after initial approval, preventing post-installation manipulation or deception.
• Mechanism: Locks tool descriptions upon client approval and verifies their integrity before execution. Any modification to the description triggers a security violation, blocking unauthorized changes from server-side updates.

⁠🛡️ Guardrails

⁠Covert Instruction Detection

Monitors incoming requests for hidden or obfuscated directives that could alter policy behavior.

• Goal: Stop attackers from slipping unnoticed commands or payloads into otherwise harmless data.
• Mechanism: Applies a library of regex patterns and binary‐encoding checks to the full request body. If any pattern matches a known covert channel (e.g., steganographic markers, hidden HTML tags, escape-sequence tricks), the request is rejected.

⁠Sensitive Pattern Detection

Block user-defined sensitive data patterns (credential paths, filesystem references).

• Goal: Block accidental or malicious inclusion of sensitive information that violates data-handling rules.
• Mechanism: Runs a curated set of regexes against all payloads and tool descriptions—matching patterns such as .env files, RSA key paths, directory traversal sequences.

⁠Shadowing Pattern Detection

Detects and blocks "shadowing" attacks, where a malicious MCP server sneaks hidden directives into its own tool descriptions to hijack or override the behavior of other, trusted tools.

• Goal: Stop a rogue server from poisoning the agent’s logic by embedding instructions that alter how a different server’s tools operate (e.g., forcing all emails to go to an attacker’s address even when the user calls a separate send_email tool).
• Mechanism: During policy load, each tool description is scanned for cross‐tool override patterns—such as <IMPORTANT> sections referencing other tool names, hidden side‐effects, or directives that apply to a different server’s API. Any description that attempts to shadow or extend instructions for a tool outside its own namespace triggers a policy violation and is rejected.

⁠Schema Misuse Prevention

Enforces strict adherence to MCP input schemas.

• Goal: Prevent malformed or unexpected fields from bypassing validations, causing runtime errors, or enabling injections.
• Mechanism: Compares each incoming JSON object against the declared schema (required properties, allowed keys, types). Any extra, missing, or mistyped field triggers an immediate policy violation.

⁠Cross-Origin Tool Access

Controls whether tools may invoke tools or services from external origins.

• Goal: Prevent untrusted or out-of-scope services from being called.
• Mechanism: Examines tool invocation requests and outgoing calls, verifying each target against an allowlist of approved domains or service names. Calls to any non-approved origin are blocked.

⁠Secrets Redaction

Automatically masks sensitive values so they never appear in logs or responses.

• Goal: Ensure that API keys, tokens, passwords, and other credentials cannot leak in plaintext.
• Mechanism: Scans every text output for known secret formats (e.g., AWS keys, GitHub PATs, JWTs). Matches are replaced with [REDACTED] before the response is sent or recorded.

These controls ensure robust runtime integrity, prevent unauthorized behavior, and provide a foundation for secure-by-design system operations.

⁠Enable guardrails

To activate guardrails in your Docker containers, define the GUARDRAILS environment variable with the protections you need.

Example: add -e GUARDRAILS="secrets-redaction sensitive-pattern-detection" to enable those guardrails.

⁠🔒 Basic Authentication via Shared Secret

Provides a lightweight auth layer using a single shared token.

• Mechanism: Expects clients to send an Authorization header with the predefined secret.
• Use Case: Quickly lock down your endpoint in development or simple internal deployments—no complex OAuth/OIDC setup required.

To turn on Basic Authentication, define BASIC_AUTH_SECRET environment variable with a shared secret.

Example: add -e BASIC_AUTH_SECRET="supersecret" to enable the basic authentication.

To get started immediately, you can use the "one-click" link below:

⁠Global scope

Press ctrl + shift + p and type Preferences: Open User Settings JSON to add the following section:

{
  "mcp": {
    "servers": {
      "acuvity-mcp-server-alibaba-cloud-ops": {
        "env": {
          "ALIBABA_CLOUD_ACCESS_KEY_ID": "TO_BE_SET",
          "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "TO_BE_SET"
        },
        "command": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "--read-only",
          "-e",
          "ALIBABA_CLOUD_ACCESS_KEY_ID",
          "-e",
          "ALIBABA_CLOUD_ACCESS_KEY_SECRET",
          "docker.io/acuvity/mcp-server-alibaba-cloud-ops:0.8.7"
        ]
      }
    }
  }
}

⁠Workspace scope

In your workspace create a file called .vscode/mcp.json and add the following section:

{
  "servers": {
    "acuvity-mcp-server-alibaba-cloud-ops": {
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "TO_BE_SET",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "TO_BE_SET"
      },
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--read-only",
        "-e",
        "ALIBABA_CLOUD_ACCESS_KEY_ID",
        "-e",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET",
        "docker.io/acuvity/mcp-server-alibaba-cloud-ops:0.8.7"
      ]
    }
  }
}

In ~/.codeium/windsurf/mcp_config.json add the following section:

{
  "mcpServers": {
    "acuvity-mcp-server-alibaba-cloud-ops": {
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "TO_BE_SET",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "TO_BE_SET"
      },
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--read-only",
        "-e",
        "ALIBABA_CLOUD_ACCESS_KEY_ID",
        "-e",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET",
        "docker.io/acuvity/mcp-server-alibaba-cloud-ops:0.8.7"
      ]
    }
  }
}

See Windsurf documentation⁠ for more info.

Add the following JSON block to your mcp configuration file:

• ~/.cursor/mcp.json for global scope
• .cursor/mcp.json for project scope

{
  "mcpServers": {
    "acuvity-mcp-server-alibaba-cloud-ops": {
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "TO_BE_SET",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "TO_BE_SET"
      },
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--read-only",
        "-e",
        "ALIBABA_CLOUD_ACCESS_KEY_ID",
        "-e",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET",
        "docker.io/acuvity/mcp-server-alibaba-cloud-ops:0.8.7"
      ]
    }
  }
}

See cursor documentation⁠ for more information.

In the claude_desktop_config.json configuration file add the following section:

{
  "mcpServers": {
    "acuvity-mcp-server-alibaba-cloud-ops": {
      "env": {
        "ALIBABA_CLOUD_ACCESS_KEY_ID": "TO_BE_SET",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET": "TO_BE_SET"
      },
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "--read-only",
        "-e",
        "ALIBABA_CLOUD_ACCESS_KEY_ID",
        "-e",
        "ALIBABA_CLOUD_ACCESS_KEY_SECRET",
        "docker.io/acuvity/mcp-server-alibaba-cloud-ops:0.8.7"
      ]
    }
  }
}

See Anthropic documentation⁠ for more information.

⁠Running locally

async with MCPServerStdio(
    params={
        "env": {"ALIBABA_CLOUD_ACCESS_KEY_ID":"TO_BE_SET","ALIBABA_CLOUD_ACCESS_KEY_SECRET":"TO_BE_SET"},
        "command": "docker",
        "args": ["run","-i","--rm","--read-only","-e","ALIBABA_CLOUD_ACCESS_KEY_ID","-e","ALIBABA_CLOUD_ACCESS_KEY_SECRET","docker.io/acuvity/mcp-server-alibaba-cloud-ops:0.8.7"]
    }
) as server:
    tools = await server.list_tools()

⁠Running remotely

async with MCPServerSse(
    params={
        "url": "http://<ip>:<port>/sse",
    }
) as server:
    tools = await server.list_tools()

See OpenAI Agents SDK docs⁠ for more info.

In your client configuration set:

• command: docker
• arguments: run -i --rm --read-only -e ALIBABA_CLOUD_ACCESS_KEY_ID -e ALIBABA_CLOUD_ACCESS_KEY_SECRET docker.io/acuvity/mcp-server-alibaba-cloud-ops:0.8.7

Simply run as:

docker run -it -p 8000:8000 --rm --read-only -e ALIBABA_CLOUD_ACCESS_KEY_ID -e ALIBABA_CLOUD_ACCESS_KEY_SECRET docker.io/acuvity/mcp-server-alibaba-cloud-ops:0.8.7

Then on your application/client, you can configure to use it like:

{
  "mcpServers": {
    "acuvity-mcp-server-alibaba-cloud-ops": {
      "url": "http://localhost:8000/sse"
    }
  }
}

You might have to use different ports for different tools.

1. Start the server in backend mode

• add an environment variable like -e MINIBRIDGE_MODE=backend
• add the TLS certificates (recommended) through a volume let's say /certs ex (-v $PWD/certs:/certs)
• instruct minibridge to use those certs with
  • -e MINIBRIDGE_TLS_SERVER_CERT=/certs/server-cert.pem
  • -e MINIBRIDGE_TLS_SERVER_KEY=/certs/server-key.pem
  • -e MINIBRIDGE_TLS_SERVER_KEY_PASS=optional
  • -e MINIBRIDGE_TLS_SERVER_CLIENT_CA=/certs/client-ca.pem

1. Start minibridge locally in frontend mode:

• Get minibridge⁠ binary for your OS.

In your client configuration, Minibridge works like any other STDIO command.

Example for Claude Desktop:

{
  "mcpServers": {
    "acuvity-mcp-server-alibaba-cloud-ops": {
      "command": "minibridge",
      "args": ["frontend", "--backend", "wss://<remote-url>:8000/ws", "--tls-client-backend-ca", "/path/to/ca/that/signed/the/server-cert.pem/ca.pem", "--tls-client-cert", "/path/to/client-cert.pem", "--tls-client-key", "/path/to/client-key.pem"]
    }
  }
}

That's it.

Minibridge offers a host of additional features. For step-by-step guidance, please visit the wiki. And if anything’s unclear, don’t hesitate to reach out!

⁠Chart settings requirements

This chart requires some mandatory information to be installed.

Mandatory Secrets:

• ALIBABA_CLOUD_ACCESS_KEY_ID secret to be set as secrets.ALIBABA_CLOUD_ACCESS_KEY_ID either by .value or from existing with .valueFrom
• ALIBABA_CLOUD_ACCESS_KEY_SECRET secret to be set as secrets.ALIBABA_CLOUD_ACCESS_KEY_SECRET either by .value or from existing with .valueFrom

⁠How to install

You can inspect the chart README:

helm show readme oci://docker.io/acuvity/mcp-server-alibaba-cloud-ops --version 1.0.0

You can inspect the values that you can configure:

helm show values oci://docker.io/acuvity/mcp-server-alibaba-cloud-ops --version 1.0.0

Install with helm

helm install mcp-server-alibaba-cloud-ops oci://docker.io/acuvity/mcp-server-alibaba-cloud-ops --version 1.0.0

From there your MCP server mcp-server-alibaba-cloud-ops will be reachable by default through http/sse from inside the cluster using the Kubernetes Service mcp-server-alibaba-cloud-ops on port 8000 by default. You can change that by looking at the service section of the values.yaml file.

⁠How to Monitor

The deployment will create a Kubernetes service with a healthPort, that is used for liveness probes and readiness probes. This health port can also be used by the monitoring stack of your choice and exposes metrics under the /metrics path.

See full charts Readme⁠ for more details about settings and runtime security including guardrails activation.