mcp-firewall

# 🛡️ mcp-firewall **The open-source security gateway for AI agents.** mcp-firewall sits between your MCP client and server, intercepting every tool call with enterprise-grade policy enforcement, real-time threat detection, and compliance-ready audit logging. ``` AI Agent ←→ mcp-firewall ←→ MCP Server ↕ Policy Engine Audit Trail Threat Feed ``` ## Why AI agents can now execute tools — read files, run commands, query databases, make HTTP requests. Without guardrails, a single prompt injection can exfiltrate your credentials, execute arbitrary code, and chain tools for privilege escalation. mcp-firewall is the WAF for AI agents. ## Quick Start ```bash pip install mcp-firewall # Wrap any MCP server with zero config mcp-firewall wrap -- npx @modelcontextprotocol/server-filesystem /tmp # Generate a starter policy mcp-firewall init ``` ## Features ### 🔒 Defense-in-Depth Pipeline Every tool call passes through 8 inbound + 4 outbound security checks: **Inbound** (request screening): 1. Kill Switch — Emergency deny-all 2. Agent Identity — RBAC per AI agent 3. Rate Limiter — Per-agent, per-tool, global 4. Injection Detector — 50+ patterns 5. Egress Control — Block SSRF, private IPs, cloud metadata 6. Policy Engine — OPA/Rego + YAML policies 7. Chain Detector — Dangerous tool sequences 8. Human Approval — Optional interactive prompt **Outbound** (response scanning): 1. Secret Scanner — API keys, tokens, private keys 2. PII Detector — Email, phone, SSN, IBAN, credit cards 3. Exfil Detector — Embedded URLs, base64, DNS tunneling 4. Content Policy — Custom domain-specific rules ### 📋 Policy-as-Code Simple YAML for common rules: ```yaml agents: claude-desktop: allow: [read_file, search] deny: [exec, shell, rm] rate_limit: 100/min rules: - name: block-credentials match: { arguments: { path: "**/.ssh/**" } } action: deny ``` Full OPA/Rego for complex policies: ```rego package mcp-firewall.policy …