MCP Security Gateway

Security gateway that proxies MCP (Model Context Protocol) server connections with real-time scanning, audit logging, and policy enforcement.

Part of the AgentSec suite -- open-source security primitives for AI agents.

Install

pip install agentsec-gateway

Premium: Get IP reputation database, advanced data flow analytics, and multi-server policy orchestration at zazmatt.gumroad.com/l/hjpwk

Quick Start

# Patch .mcp.json to route all MCP servers through the gateway
mcp-gateway install

# That's it. All MCP traffic is now scanned and logged.

How It Works

Claude Code                MCP Gateway              MCP Server
    |                          |                         |
    |--- JSON-RPC request ---->|                         |
    |                          |-- scan for secrets ---->|
    |                          |-- scan for injections ->|
    |                          |-- log to audit trail -->|
    |                          |--- forward request ---->|
    |                          |                         |
    |                          |<--- response -----------|
    |                          |-- scan for leakage ---->|
    |                          |-- log to audit trail -->|
    |<--- forward response ----|                         |

The gateway wraps each MCP server command in .mcp.json so all stdio traffic passes through a transparent proxy. It scans for:

• Secret leakage -- API keys, tokens, passwords, PII in tool parameters
• Prompt injection -- attempts to override system instructions via tool arguments
• Path traversal -- ../etc/passwd, ~/.ssh/ style attacks
• Command injection -- shell metacharacters, subshell execution
• Data exfiltration -- secrets in server responses flowing back to Claude

CLI Reference

Configuration

Create .mcp-gateway/policy.yaml to define per-server policies:

servers:
  filesystem:
    allowed_tools: ["read_*", "list_*", "search_*"]
    blocked_tools: ["write_*", "delete_*"]
    max_calls_per_minute: 30
    data_classification: internal

  gmail:
    allowed_tools: ["gmail_search*", "gmail_read*"]
    blocked_tools: ["gmail_create_draft", "gmail_send*"]
    max_calls_per_minute: 10
    data_classification: confidential

Policy Fields

Security Features

• Secret scanning -- 23 pattern rules covering API keys, tokens, passwords, PII (SSN, credit cards)
• High-entropy detection -- Shannon entropy analysis catches unknown secret formats
• Prompt injection detection -- catches "ignore previous instructions", developer mode, system tag injection
• Path traversal detection -- blocks ../, /etc/passwd, ~/.ssh/ access attempts
• Command injection detection -- catches shell metacharacters, subshells, pipe-to-bash
• Tamper-proof audit log -- SHA-256 hash chain on every log entry
• Server reputation tracking -- trust scores degrade on violations
• Data flow monitoring -- per-server byte counting with anomaly detection

Architecture

Built on agentsec-core for scanning, policy, and audit primitives. Uses synchronous threading for the stdio proxy (no asyncio complexity).

Free vs Premium

Get Premium -- $10

Development

pip install -e ".[dev]"
pytest
ruff check .

License

MIT