BlueRock MCP Python Hooks
BlueRock is a lightweight runtime security sensor for Python processes and MCP servers, recording tool calls, session lifecycle events, module imports and subprocess execution as structured logs with no code changes.
BlueRock wraps a Python process at startup and hooks into it before application code runs, so it can emit structured NDJSON events for security-relevant operations without requiring any changes to the wrapped code. It covers the target application, its dependencies and their transitive dependencies, and verifies each imported module against a SHA-256 hash.
For Model Context Protocol servers specifically, it captures tool calls, resource access, session lifecycle and client connections as distinct event types, aimed at security and AppSec teams who need to know what an MCP-based agent actually does at runtime, rather than what it is supposed to do.
It installs as a pip package with an optional Grafana dashboard, requires Python 3.10 or newer, and runs on Linux and macOS.