{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_j5pc6zhp7rp2","handle":"mcp-firewall","url":"https://wellknown.network/agents/mcp-firewall","links":{"self":"https://wellknown.network/agents/mcp-firewall/record.json","html":"https://wellknown.network/agents/mcp-firewall","markdown":"https://wellknown.network/agents/mcp-firewall/record.md","api":"https://wellknown.network/api/v1/agents/mcp-firewall","status":"https://wellknown.network/api/v1/agents/mcp-firewall/status","claim":"https://wellknown.network/agents/mcp-firewall/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/mcp-firewall/claim.json","badge":"https://wellknown.network/agents/mcp-firewall/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/mcp-firewall/history","tools":"https://wellknown.network/api/v1/agents/mcp-firewall/tools"},"ard":{"identifier":"urn:air::server:mcp-firewall","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"mcp-firewall","summary":"The open-source security gateway for AI agents. Policy enforcement, threat detection, and compliance-ready audit logging for MCP.","description":"# 🛡️ mcp-firewall\n\n**The open-source security gateway for AI agents.**\n\nmcp-firewall sits between your MCP client and server, intercepting every tool call with enterprise-grade policy enforcement, real-time threat detection, and compliance-ready audit logging.\n\n```\nAI Agent ←→ mcp-firewall ←→ MCP Server\n               ↕\n         Policy Engine\n         Audit Trail\n         Threat Feed\n```\n\n## Why\n\nAI agents can now execute tools — read files, run commands, query databases, make HTTP requests. Without guardrails, a single prompt injection can exfiltrate your credentials, execute arbitrary code, and chain tools for privilege escalation.\n\nmcp-firewall is the WAF for AI agents.\n\n## Quick Start\n\n```bash\npip install mcp-firewall\n\n# Wrap any MCP server with zero config\nmcp-firewall wrap -- npx @modelcontextprotocol/server-filesystem /tmp\n\n# Generate a starter policy\nmcp-firewall init\n```\n\n## Features\n\n### 🔒 Defense-in-Depth Pipeline\nEvery tool call passes through 8 inbound + 4 outbound security checks:\n\n**Inbound** (request screening):\n1. Kill Switch — Emergency deny-all\n2. Agent Identity — RBAC per AI agent\n3. Rate Limiter — Per-agent, per-tool, global\n4. Injection Detector — 50+ patterns\n5. Egress Control — Block SSRF, private IPs, cloud metadata\n6. Policy Engine — OPA/Rego + YAML policies\n7. Chain Detector — Dangerous tool sequences\n8. Human Approval — Optional interactive prompt\n\n**Outbound** (response scanning):\n1. Secret Scanner — API keys, tokens, private keys\n2. PII Detector — Email, phone, SSN, IBAN, credit cards\n3. Exfil Detector — Embedded URLs, base64, DNS tunneling\n4. Content Policy — Custom domain-specific rules\n\n### 📋 Policy-as-Code\n\nSimple YAML for common rules:\n```yaml\nagents:\n  claude-desktop:\n    allow: [read_file, search]\n    deny: [exec, shell, rm]\n    rate_limit: 100/min\n\nrules:\n  - name: block-credentials\n    match: { arguments: { path: \"**/.ssh/**\" } }\n    action: deny\n```\n\nFull OPA/Rego for complex policies:\n```rego\npackage mcp-firewall.policy\n\n…","publisher":null,"homepage":"https://github.com/ressl/mcp-firewall/tree/main/docs","repository":"https://github.com/ressl/mcp-firewall/tree/main/docs","version":"0.1.0","license":"AGPL-3.0-or-later","protocols":["mcp"],"tags":["mcp","security","firewall","ai-agents","gateway","compliance","dora","audit","policy","model-context-protocol"],"pricing":null,"endpoints":[{"url":"pypi:mcp-firewall","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi"}},"derived":{"capabilities":[{"slug":"dev.filesystem","name":"Filesystem","confidence":1,"provenance":"derived"},{"slug":"dev.terminal","name":"Terminal & Shell","confidence":1,"provenance":"derived"},{"slug":"security.scanning","name":"Security Scanning","confidence":0.859,"provenance":"derived"},{"slug":"data.database","name":"Databases","confidence":0.791,"provenance":"derived"}],"categories":["data","dev","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"mcp-firewall","registry":"pypi","observedAt":"2026-10-28T11:27:14.664Z","publishedAt":"2026-02-19T16:42:38.234043Z","latestVersion":"0.1.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"mcp-firewall","url":"https://pypi.org/project/mcp-firewall/","firstSeenAt":"2026-09-10T01:20:51.662Z","fetchedAt":"2026-10-28T11:25:40.244Z","normalizedAt":"2026-10-28T11:25:40.244Z"}]},"firstSeenAt":"2026-09-10T01:20:51.662Z","updatedAt":"2026-10-28T11:27:14.664Z"}