@aiclude/mcp-guard

Intercepts all outbound MCP tool invocations at the protocol level before execution, applies configurable security policies (allowlists, denylists, parameter validation rules), and either permits or blocks execution based on policy match. Uses a proxy middleware pattern that sits between the MCP client and server, inspecting the tool name, parameters, and execution context against a declarative policy ruleset.

Analyzes tool parameters and execution context for indicators of prompt injection attacks (e.g., suspicious patterns in string parameters that attempt to override tool behavior or escape context). Uses pattern matching, heuristic analysis, or optional integration with LLM-based classifiers to detect malicious payloads and either sanitize parameters or block execution. Operates on the parameter values before they reach the underlying tool implementation.

Validates all tool call parameters against strict schemas before execution, ensuring parameters match expected types, formats, ranges, and constraints. Uses JSON Schema or similar declarative validation rules to reject malformed or out-of-bounds parameters that could cause tool misbehavior or security issues. Validation happens synchronously at the proxy layer, blocking invalid calls before they reach the tool implementation.

Enforces fine-grained access control rules based on execution context (caller identity, tool name, parameter values, execution environment, time-based policies). Uses a context evaluation engine that matches incoming tool calls against rules like 'allow tool X only if caller is admin' or 'block file deletion after business hours'. Rules are expressed declaratively and evaluated synchronously at the proxy layer before tool execution.

Logs all tool calls (allowed and blocked) with full context including caller identity, tool name, parameters, decision reason, timestamp, and execution result. Stores logs in a structured format (JSON) that can be queried, analyzed, and exported for compliance audits. Integrates with optional external logging systems (e.g., Datadog, Splunk) via standard log sinks. Provides request tracing IDs to correlate tool calls across distributed systems.

Enforces rate limits on tool calls to prevent abuse, DoS attacks, or resource exhaustion. Supports multiple rate limiting strategies (per-caller, per-tool, per-caller-per-tool, time-window based) and can apply different limits based on execution context. Uses token bucket or sliding window algorithms to track call rates and reject calls that exceed configured limits. Provides configurable backoff strategies and quota reset policies.

Provides a declarative configuration format (JSON/YAML) for defining all security policies (allowlists, denylists, parameter validation, access control, rate limits) in a single place. Policies are version-controlled, auditable, and can be updated without code changes. Includes schema validation for policy definitions and provides clear error messages for misconfiguration. Supports policy composition and inheritance to reduce duplication.

Integrates with external identity providers (OAuth2, SAML, OIDC) and authorization systems (RBAC, ABAC, policy engines) to make access control decisions based on external context. Supports token validation, role/attribute lookup, and delegation to external policy engines. Caches identity and authorization data to minimize latency and external service dependencies. Provides hooks for custom authorization logic via pluggable adapters.