Claude Code + MCP セキュリティ設計完全ガイド｜OAuth 2.1認証・ツール毒性化対策・最小権限・監査ログ

{
  "client_id": "https://app.example.com/oauth/client-metadata.json",
  "client_name": "My MCP Client",
  "client_uri": "https://app.example.com",
  "redirect_uris": [
    "http://127.0.0.1:3000/callback"
  ],
  "grant_types": ["authorization_code"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none"
}

import secrets
import time
from typing import Optional

class ConsentRegistry:
    """MCPプロキシでのConfused Deputy攻撃を防ぐ同意レジストリ"""

    def __init__(self):
        # { user_id: { client_id: { scope: str, granted_at: float } } }
        self._consents: dict = {}
        # 同意の有効期限（秒）
        self.CONSENT_TTL = 3600

    def has_consent(self, user_id: str, client_id: str, scope: str) -> bool:
        """ユーザー・クライアント・スコープの組み合わせで同意済みか確認"""
        entry = self._consents.get(user_id, {}).get(client_id)
        if not entry:
            return False
        # スコープが一致し、有効期限内であること
        if entry["scope"] != scope:
            return False
        if time.time() - entry["granted_at"] > self.CONSENT_TTL:
            return False
        return True

    def grant_consent(self, user_id: str, client_id: str, scope: str) -> None:
        """同意を記録する（ユーザーが明示的に同意した後に呼ぶ）"""
        if user_id not in self._consents:
            self._consents[user_id] = {}
        self._consents[user_id][client_id] = {
            "scope": scope,
            "granted_at": time.time(),
        }

    def revoke_consent(self, user_id: str, client_id: Optional[str] = None) -> None:
        """同意を取り消す"""
        if client_id:
            self._consents.get(user_id, {}).pop(client_id, None)
        else:
            self._consents.pop(user_id, None)


# MCPプロキシのOAuthフォワード処理での使用例
registry = ConsentRegistry()

def forward_to_third_party(user_id: str, client_id: str, scope: str, auth_code: str):
    """サードパーティAPIへのフォワード前に同意を必ず確認"""
    if not registry.has_consent(user_id, client_id, scope):
        raise PermissionError(
            f"未承認のフォワードリクエスト: user={user_id} client={client_id} scope={scope}"
        )
    # 同意確認後のみサードパーティへフォワード
    return _do_forward(auth_code)

{
  "permissions": {
    "deny": [
      "mcp__filesystem__write_file",
      "mcp__filesystem__delete_file",
      "mcp__github__push_files"
    ],
    "allow": [
      "mcp__filesystem__read_file",
      "mcp__filesystem__list_directory",
      "mcp__github__get_file_contents",
      "mcp__github__search_code"
    ]
  }
}

import secrets
from typing import Dict

# 仮名化テーブル（MCPサーバー内部で管理）
pseudonym_map: Dict[str, str] = {}
reverse_map: Dict[str, str] = {}

def pseudonymize(real_value: str, prefix: str = "TOKEN") -> str:
    """実データを仮名に変換してLLMに渡す"""
    if real_value not in pseudonym_map:
        token = f"{prefix}_{secrets.token_hex(8).upper()}"
        pseudonym_map[real_value] = token
        reverse_map[token] = real_value
    return pseudonym_map[real_value]

def restore(token: str) -> str:
    """LLMの出力に含まれる仮名を実データに戻す"""
    return reverse_map.get(token, token)

# 使用例：顧客データ取得ツール
def get_customer_tool(customer_id: str) -> dict:
    customer = db.fetch_customer(customer_id)
    # LLMには仮名化したデータのみ返す
    return {
        "customer_id": pseudonymize(customer.id, "CUST"),
        "email": pseudonymize(customer.email, "EMAIL"),
        "name": customer.name,  # 氏名は仮名化しない例
    }

{
  "permissions": {
    "deny": [
      "mcp__third-party-unknown__*",
      "mcp__filesystem__write_file",
      "mcp__filesystem__delete_file"
    ],
    "allow": [
      "mcp__github__get_file_contents",
      "mcp__github__search_code",
      "mcp__filesystem__read_file"
    ]
  }
}

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "mcp__.*",
        "hooks": [
          {
            "type": "command",
            "command": "jq -c --arg ts $(date -u +%Y-%m-%dT%H:%M:%SZ) '{timestamp: $ts, tool: .tool_name, input: .tool_input, result_size: (.tool_result | length)}' >> ~/mcp-audit.log",
            "async": true
          }
        ]
      }
    ]
  }
}

#!/bin/bash
INPUT=$(cat)
TOOL=$(echo "$INPUT" | jq -r '.tool_name')

# MCPツールの場合のみ検証
if [[ "$TOOL" != mcp__* ]]; then
  exit 0
fi

# ツール入力に機密キーワードが含まれていないか確認
TOOL_INPUT=$(echo "$INPUT" | jq -r '.tool_input | tostring')
SECRETS_PATTERN="(password|secret|private_key|api_key|access_token)"

if echo "$TOOL_INPUT" | grep -iE "$SECRETS_PATTERN" > /dev/null 2>&1; then
  echo "BLOCKED: MCPツール引数に機密キーワードが検出されました: $TOOL" >&2
  exit 2
fi

exit 0

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "mcp__.*",
        "hooks": [
          {
            "type": "command",
            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/mcp-param-validator.sh"
          }
        ]
      }
    ]
  }
}

# .claude/settings.json を Git 管理下に置く
git add .claude/settings.json
git commit -m "chore: update Claude Code MCP permissions"

# pre-commit フックで設定変更に approve を要求
# .git/hooks/pre-commit に追加
if git diff --cached --name-only | grep -q ".claude/settings.json"; then
  echo "Warning: Claude Code settings変更を検知。セキュリティレビューを推奨します。"
fi

# Ollamaをバックエンドとして設定
export ANTHROPIC_AUTH_TOKEN=ollama
export ANTHROPIC_API_KEY=""
export ANTHROPIC_BASE_URL=http://localhost:11434

# モデルを指定してClaude Codeを起動
claude --model qwen3:14b

ANTHROPIC_AUTH_TOKEN=ollama ANTHROPIC_BASE_URL=http://localhost:11434 ANTHROPIC_API_KEY="" claude --model llama3.3:70b

{
  "permissions": {
    "deny": [
      "Bash(rm -rf *)",
      "Bash(sudo *)",
      "Bash(curl * | bash)",
      "Bash(wget * | sh)",
      "Bash(git push --force *)",
      "Read(./.env*)",
      "Read(~/secrets/**)",
      "Read(~/.ssh/**)"
    ],
    "allow": [
      "Bash(npm run *)",
      "Bash(git add *)",
      "Bash(git commit *)",
      "Bash(git status)",
      "Bash(git diff *)"
    ]
  }
}

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "mcp__.*",
        "hooks": [
          {
            "type": "http",
            "url": "http://localhost:8080/mcp-guard/pre-tool-use",
            "headers": {
              "Authorization": "Bearer $MCP_GUARD_TOKEN"
            },
            "allowedEnvVars": ["MCP_GUARD_TOKEN"]
          }
        ]
      }
    ]
  }
}

# .claude/settings.json を編集して不審なMCPサーバーを無効化
# mcpServers から対象サーバーを削除するか deny で全ツールをブロック

# 例：third-party-server の全ツールを即時ブロック
# .claude/settings.json の permissions.deny に追加:
# "mcp__third-party-server__*"

# 変更を即時反映（セッションを再起動）
echo "MCPサーバーを無効化しました。Claude Codeを再起動してください。"

# PostToolUseフックで記録した監査ログを確認
# ~/mcp-audit.log の例
cat ~/mcp-audit.log | jq -r '. | select(.tool_name | startswith("mcp__third-party")) | [.timestamp, .tool_name, (.input | tostring)] | @tsv'

# 特定の時間帯の操作を抽出
cat ~/mcp-audit.log | jq -r '. | select(.timestamp >= "2026-03-20T00:00:00Z")' | head -50

# 大量呼び出し（1分間に10回超）を検出
cat ~/mcp-audit.log | jq -r '.timestamp[:16]' | sort | uniq -c | sort -rn | head -20