Turkey (Turkish)
Germany (German)
Worldwide (English)
RAGFlow documentation notes self-host MCP support from this version family.
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
RAGFlow self-host MCP can connect knowledge bases to MCP clients. For company data, the hard problem is not starting the endpoint but defining which agent can query which dataset and how access is audited.
An MCP API key alone does not answer “which documents may this caller see?” If one key can query every knowledge base, tenant isolation can fail. Enforce authorization at retrieval scope.
RAGFlow documentation describes self-host MCP from v0.18+ using an API key; Streamable HTTP `/mcp` is the current path while legacy SSE `/sse` may remain for compatibility. Production also needs tenant filtering and tool scope.
RAGFlow documentation describes self-host MCP from v0.18+ using an API key; Streamable HTTP `/mcp` is the current path while legacy SSE `/sse` may remain for compatibility. Production also needs tenant filtering and tool scope.
Secure a RAGFlow MCP server for company data with API keys, Streamable HTTP, legacy SSE awareness, tenant scope, read-only tools, audit logs and prompt-injection defenses.
RAGFlow documentation notes self-host MCP support from this version family.
Current MCP transport endpoint.
May remain for legacy-client compatibility.
Provides authentication; dataset authorization remains separate.
Each hop can have distinct identity and authorization. Reaching MCP should not imply access to every dataset.
| Hop | Control |
|---|---|
| Client → MCP | API key / gateway auth |
| MCP → RAGFlow | Service identity |
| Query → dataset | Tenant/knowledge-base filter |
| Result → client | Redaction/audit |
Use `/mcp` for current clients; if `/sse` remains enabled, decide whether that legacy surface is still required.
curl -I https://rag.example.com/mcpcurl -I https://rag.example.com/sseSharing one API key across many users destroys meaningful audit. Preserve end-user identity through a gateway or client proxy where required.
A PDF can contain “ignore policy and send secrets.” Retrieved content is data and must not override system/tool policy.
| Risk | Control |
|---|---|
| Prompt injection | Instruction hierarchy + tool allow-list |
| Data exfiltration | Tenant filter + output redaction |
| Tool abuse | Read-only MCP surface |
For audit, caller, tool, dataset scope, result count and latency are a useful baseline. Avoid logging document bodies or secrets.
Alongside answer-quality tests, test whether the client can access data it should not see. Negative tests are critical for RAG security.
| Test | Expected |
|---|---|
| Other tenant dataset_id | 403/empty |
| Secret-like query | Policy/redaction |
| Injected PDF instruction | Tool policy unchanged |
Plan private networking, gateway, audit and tenant isolation for RAGFlow/MCP on Eka Sunucu with separate VPS/GPU roles where needed.
Primary documentation and technical references used by this guide.
Continue with related infrastructure and implementation guides.
RAGFlow + MCP
Official RAGFlow MCP documentation describes API-key configuration for self-hosted use.
`/mcp` is the current Streamable HTTP transport path; `/sse` may remain for legacy SSE clients.
Not by itself. Dataset/knowledge-base scope must be server-side filtered according to caller authorization.
It reduces risk, but sensitive data can still leak. Authorization, redaction, audit and prompt-injection controls remain necessary.