# TraconMcpSecurityOptions

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.traconmcpsecurityoptions/
> Summary: TraconMcpSecurityOptions: The security boundary applied to stored MCP server definitions.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Abstractions.dll</code></div>

The security boundary applied to stored MCP server definitions.

```csharp
public sealed class TraconMcpSecurityOptions
```

<dl class="api-relations"><dt>Inheritance</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object">object</a> ← <a href="/api/tracon.traconmcpsecurityoptions/">TraconMcpSecurityOptions</a></dd><dt>Inherited Members</dt><dd><a href="https://learn.microsoft.com/dotnet/api/system.object.gettype">object.GetType()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.tostring">object.ToString()</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object)">object.Equals(object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.equals#system-object-equals(system-object-system-object)">object.Equals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.referenceequals">object.ReferenceEquals(object?, object?)</a>, <a href="https://learn.microsoft.com/dotnet/api/system.object.gethashcode">object.GetHashCode()</a></dd></dl>

## Remarks

Read from the `Tracon:Mcp` configuration section, the same
section as the MCP package's own connection settings.

This type lives in the abstractions package on purpose: the rule is
enforced in two places that do not see each other — the endpoint that
saves a server definition (`Tracon.AspNetCore`) and the transport
that resolves the key at connection time (`Tracon.Mcp`). One
shared type keeps the two from drifting apart.

## Constructors

### <a id="Tracon_TraconMcpSecurityOptions__ctor"></a> TraconMcpSecurityOptions\(\)

```csharp
public TraconMcpSecurityOptions()
```

## Fields

### <a id="Tracon_TraconMcpSecurityOptions_SectionName"></a> SectionName

Gets the configuration section name.

```csharp
public const string SectionName = "Tracon:Mcp"
```

#### Field Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

## Properties

### <a id="Tracon_TraconMcpSecurityOptions_AllowedConfigurationPrefix"></a> AllowedConfigurationPrefix

Gets or sets the only prefix under which a configuration key may be
referenced by an MCP server definition. Default is
`"Tracon:McpSecrets:"`.

```csharp
public string AllowedConfigurationPrefix { get; set; }
```

#### Property Value

 [string](https://learn.microsoft.com/dotnet/api/system.string)

#### Remarks

Covers every key name a definition carries: each entry of
`headerConfigurationKeys` and `oauthClientSecretConfigurationKey`.

A security boundary, not a convenience default — the same reason as
[TraconTenantProviderOptions.AllowedConfigurationPrefix](/api/tracon.tracontenantprovideroptions/#Tracon_TraconTenantProviderOptions_AllowedConfigurationPrefix).
A definition never carries a secret value, only the name of the key the
value is read from. Without this restriction that name could
point at any configuration key in the application, and its value would
be sent to the remote MCP server as an `Authorization` header.