Wikiservice: Refresh MemCP documentation: accuracy, operational guidance, performance profile and maintained API reference

2026-08-28T09:59:20Z

Refresh MemCP documentation: accuracy, operational guidance, performance profile and maintained API reference

New page

<span id="security-and-authentication"></span>
= Security and Authentication =

A fresh data directory creates <code>root</code> with the initial password supplied by <code>--root-password</code> or Docker <code>ROOT_PASSWORD</code>; the development default is <code>admin</code>. Set a strong secret before exposing any listener.

MemCP supports users, password changes, grants/revokes, and database access policies through SQL and the dashboard. Use a least-privilege account for each application and a separate read-only account for migration or validation.

HTTP endpoints use Basic authentication. Protect them with TLS at a trusted reverse proxy or private network; Basic credentials are only encoded, not encrypted. Restrict the MySQL TCP port and Unix socket. Disable unused API or MySQL listeners.

SQL/Scheme consoles, process controls, settings, logs, custom handlers, and storage-backend credentials are administrative capabilities. Logs can contain queries and data. Config files, data directories, sockets, backups, and remote credentials require filesystem/service permissions appropriate to the deployment.

MemCP is Beta and should be defense-in-depth deployed. Test authentication and authorization while logged out and as every role after upgrades.

Security and Authentication - Revision history

Wikiservice: Refresh MemCP documentation: accuracy, operational guidance, performance profile and maintained API reference