An organization deploys a Model Context Protocol (MCP) server that provides agents with access to internal APIs and databases. The MCP server is accessible over HTTPS. The security team wants to ensure that only the organization's self-hosted GitHub Actions runners can call the MCP server. Which network-level control best enforces this restriction?
Select an answer to reveal the explanation.
Short Explanation and Infographic
TLS proves the server is who it says it is, but doesn't control who is allowed to call it. An IP allowlist at the network layer is a bouncer that checks your address before you even knock on the door — if you're not on the list, the connection is dropped at the firewall before any authentication exchange can happen. The correct answer is B.
Full explanation below image
Full Explanation
Defense in depth for a sensitive internal MCP server should include controls at multiple layers, but the network layer is the most fundamental. An IP allowlist configured on the server's firewall or cloud security group (AWS Security Group, Azure NSG, GCP Firewall Rule) drops inbound connections from unauthorized source IPs at the network level, before any application-layer authentication can take place.
For self-hosted GitHub Actions runners, the runners' outbound IP addresses are known and static (the organization controls the runner infrastructure). Configuring the MCP server to accept inbound HTTPS only from those specific IPs means that even if an attacker obtains an API key or credentials for the MCP server, they cannot connect from outside the allowed IP range.
This implements the principle of network-layer access control as a first line of defense, complementing application-layer authentication (mutual TLS, API keys, OIDC) as a second layer.
Option A is incorrect because requiring a TLS certificate controls the server's identity (the client knows they're talking to the right server) but does not restrict which clients can call the server. Any client that can reach the server over HTTPS can initiate a connection.
Option C is incorrect because HTTP basic authentication is application-layer, not network-layer. The connection is established and the authentication exchange happens before the server rejects unauthorized clients. Basic authentication also transmits credentials in base64 (not encrypted by itself) and is weaker than certificate-based or token-based approaches.
Option D is incorrect because API key authentication alone in a public subnet means any attacker who can reach the server (any IP in the world) can attempt authentication and potentially brute-force or steal the API key. Network exposure should be minimized before authentication is even attempted.