European-Parliament-MCP-Server: Skill for Claude Code

Security By Design Skill

Context

This skill applies when:

• Implementing MCP protocol tools and handlers
• Exposing European Parliament data through APIs
• Handling user inputs or external data sources
• Implementing authentication or authorization mechanisms
• Processing sensitive or classified information
• Designing rate limiting or abuse prevention
• Implementing audit logging and monitoring
• Writing security-critical validation logic
• Handling errors and exceptions securely
• Configuring network security or TLS

Security is foundational, not optional. Every feature must be designed with security in mind from the start, following the principle of "secure by default" and implementing defense-in-depth strategies aligned with Hack23 AB's ISMS policies.

Rules

1. Never Trust Input: Validate and sanitize all user inputs - treat everything as potentially malicious
2. Fail Securely: Systems must fail to a secure state, never expose sensitive information in errors
3. Principle of Least Privilege: Grant minimal permissions required for functionality, nothing more
4. Defense in Depth: Implement multiple overlapping security controls (validation + rate limiting + audit logging)
5. Encrypt Everything: Use TLS 1.3+ for transit, AES-256 for at rest, never store secrets in plaintext
6. Audit All Actions: Log authentication attempts, authorization failures, input validation errors
7. Rate Limit Aggressively: Protect against abuse, DoS attacks, and resource exhaustion
8. Validate Schema: Use strict schema validation for all MCP tool inputs and outputs
9. Sanitize Output: Encode data appropriately to prevent injection attacks (XSS, command injection)
10. Secure Defaults: All features must be secure by default, require opt-in for permissive settings
11. No Secrets in Code: Never commit API keys, tokens, or credentials to source control
12. Regular Updates: Keep dependencies updated, scan for vulnerabilities continuously
13. Assume Breach: Design systems assuming attackers will get in - limit blast radius
14. Document Security: Reference ISMS policies, document threat models and security controls
15. Test Security: Write tests for authentication, authorization, input validation, and error handling