Security

Panel

Serve everything over HTTPS with valid certificates (networking).
Keep the panel updated — security fixes ship in releases (updating).
Restrict who can reach the admin UI by network (VPN, allowlist) in addition to passwords.
Never expose the database or Redis ports to the internet; the bundled compose stack binds both to loopback (configuration).

Accounts and access

Few admins, named accounts, prompt offboarding (users).
Least-privilege roles for staff; scoped API keys for integrations.
Treat node API keys and backup encryption keys as crown jewels: generated randomly, stored once, rotated on suspicion.

Security settings

Open Admin → Security. Settings take effect when you select Save in each section.

Rate Limits — per-category request and message budgets: Auth requests, File operations, Console input, Console output lines / sec, Console output bytes / sec, Agent messages / sec, Agent metrics / sec, Server metrics / sec, and Max buffer (MB). Each rate limit has a count and a time window (second, minute, hour, day, or month).
Email Verification — Require verified email before sign-in. The toggle is disabled until SMTP is configured under Admin → System. If a saved payload asks for it while mail is not configured, the backend stores it as off instead of failing the save, so the other security settings still apply.
Lockout Policy — Max attempts, Window (minutes), Duration (minutes), and Audit retention (days). Failed sign-ins lock out per email + IP combination.
File uploads — Tunnel requests, Max upload size (MB) (up to 10240 MB), Max pending per node, and Max concurrent (agent). The upload size caps a single file in the file browser on every node; SFTP transfers are limited only by the server’s remaining disk. Max concurrent needs an agent restart to take effect.
Auth Lockouts — recent lockout entries with a Clear lockout action.

Open self-registration is not on this page. It is governed by REGISTRATION_ENABLED, which overrides the stored setting: set it in Admin → Environment and restart the panel (configuration). The setup wizard turns the stored setting off.

Panel MCP endpoint (AI assistants)

The panel can expose itself as a Streamable HTTP MCP server so an AI assistant can manage servers, nodes, users, and the rest of the panel API with the same permissions as the API key it is given. It is disabled by default.

Prerequisites: an admin account, and a panel API key for the assistant (Profile > API keys) scoped to only the permissions it needs.

In Admin → Security, find the Panel MCP access section.
Turn on Enable panel MCP endpoint. A confirmation dialog explains the risks; select I understand, enable anyway. It takes effect immediately — no restart.
Optionally set the Tool budget (per key / min) (10–5000, default 300). The MCP endpoint field shows the exact URL to copy — https://panel.example.com/api/mcp.
Select Save.
Point the MCP client at that endpoint with the dedicated API key as the Bearer credential.
Verify with a read-only call first (for example whoami), then try one list_servers before granting broader scopes.

Session cookies are never accepted on this endpoint, so it cannot be abused from a browser session. Every tool call is permission-checked and audit-logged exactly like direct API use.

Nodes

Only the agent’s required ports plus game allocations listen publicly.
Apply OS and runtime updates on a rhythm; nodes run untrusted game code and third-party mods by design.
Review imported egg install scripts — they are the largest untrusted-code surface in normal operation.

Report a vulnerability

Do not open a public issue for a suspected security bug. Report it privately to the maintainers and expect coordinated disclosure: report, fix window, then a public advisory.

Networking — TLS and proxy layout.
Users and roles — account and permission hygiene.
Updating Catalyst — ship security fixes promptly.
Importing eggs — the untrusted-code boundary.