Desplegar User Scanner: aislar módulos, proxies, informes y MCP

Pin the runtime and package

Fija Python/package en un entorno aislado, limita dominios, concurrencia, proxies y MCP; cifra y redacta informes, define retención y prueba timeouts, exportaciones parciales y cleanup.

Keep the scanner separate from production credentials and personal datasets. A clean environment makes upgrades and removals testable.

Control outbound access

Allow-list public domains required by the selected modules, set request timeouts and concurrency, and validate proxies before use. Proxy rotation is a routing choice, not a permission bypass; honor provider terms and stop on blocks or consent boundaries.

Keep MCP on stdio or a trusted local boundary. Do not expose a scanner server to an untrusted network or let a client inject arbitrary proxy files, output paths, or recursive depth.

Store reports safely

Write JSON/CSV/PDF reports to an access-controlled directory, encrypt at rest, and retain only fields needed for the purpose. Include target hash or normalized identifier, module set, timestamp, software version, proxy mode, and reviewer decision without storing secrets.

Test a dry run, a module timeout, a proxy failure, a partial report, and cleanup. A process exit of zero does not prove every platform response was available or accurate.

Operate and recover

Monitor request errors, rate limits, latency, output size, pivot depth, and storage. If credentials, reports, or a proxy are exposed, stop scans, revoke access, quarantine outputs, restore a known-good environment, and document deletion or notification.