# mcp-firewall

An open-source security gateway that sits between an MCP client and server, screening every tool call through a multi-stage pipeline of rate limiting, injection detection, SSRF and egress control, policy enforcement and dangerous-chain detection.

mcp-firewall sits between an AI agent's MCP client and server so that tool calls, such as reading files, running commands, querying databases or making HTTP requests, pass through policy enforcement, threat detection and audit logging instead of executing unchecked. It wraps any MCP server with zero configuration and can generate a starter policy.

Inbound requests pass through seven stages: an emergency kill switch, per-agent, per-tool and global rate limiting, pattern-based prompt-injection detection with configurable sensitivity, egress control that blocks SSRF, private IPs and cloud metadata endpoints, a threat feed of known attack patterns, a YAML policy engine with per-agent role-based access control, and a chain detector for dangerous tool sequences, with an interactive approval prompt for rules that require it and a fail-closed default in non-interactive sessions. Outbound responses are scanned for leaked secrets, such as API keys, tokens and private keys, and personal data such as emails, phone numbers, national IDs and card numbers.

Policies are written as simple YAML rules with allow and deny lists and rate limits per agent, a real-time dashboard shows a live event feed and statistics, and an optional signed audit trail uses Ed25519 to sign every event. Built with Python. AGPL-3.0 licensed.

Website: https://github.com/ressl/mcp-firewall