Security middleware for MCP. Blocks prompt injection, PII leakage, and resource exhaustion.
MCPpedia last refreshed this data
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"io-github-vaquarkhan-mcp-bastion": {
"args": [
"-y",
"@mcp-bastion/core"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Enterprise-Grade Security Middleware for the Model Context Protocol
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@mcp-bastion/core' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
No known CVEs.
Checked @mcp-bastion/core against OSV.dev.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in security
mcpki-server is the backend infrastructure for https://www.mcpki.org, enabling secure public key management and autonomous certificate handling for large language models (LLMs).
AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.
Model Context Protocol for WinDBG
Regression testing for MCP servers. Checks capabilities, invokes tools, detects schema drift.
MCP Security Weekly
Get CVE alerts and security updates for io.github.vaquarkhan/mcp-bastion and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Current release: 3.3.1 · Docker v3.3.1 · 18 PyPI packages · CHANGELOG
The Zero-Trust control plane for MCP agents. Your agent can call databases, APIs, and shell tools. One bad prompt can leak PII; one runaway loop can burn your API budget in minutes; three agents on one server with no identity boundary is a confused-deputy incident waiting to happen. MCP-Bastion wraps your MCP server with local guardrails: agent IAM, supply-chain checksums, injection blocking, PII redaction, and denial-of-wallet caps, under 5ms overhead, with no third-party safety API.
Guiding rule: Stay a zero-infra, drop-in library - the guardrail brain that composes with any gateway, not a gateway itself. Strategy: docs/ZERO_INFRA_STRATEGY.md.
| Phase | What | Command |
|---|---|---|
| Scan | Static tool-definition checks before deploy (injection, secrets, homoglyphs, fingerprint drift, schema preconditions) | mcp-bastion scan tools.json |
| Audit | Local MCP client-config risk report (over-broad tools, standing credentials, filesystem servers) | mcp-bastion audit |
| Test | Integrated red-team harness against your bastion.yaml policy | mcp-bastion redteam |
| Enforce | Runtime middleware on every MCP method | secure_fastmcp(mcp) or bastion.yaml |
scan vs audit - different inputs, different questions
mcp-bastion scan | mcp-bastion audit | |
|---|---|---|
| Looks at | A tool catalog (tools.json / tools/list export) | MCP client configs on disk (mcp.json, Claude Desktop config, etc.) |
| Asks | “Is this tool metadata poisoned or drifted?” | “What can agents already reach on this machine?” |
| Finds | Injection in descriptions, secrets in schemas, homoglyphs, fingerprint drift, weak/unbounded inputSchema shapes | Over-broad tool grants (*), standing credentials in env, filesystem-server hints |
| When | Before you ship or attach a server’s tools (CI / pre-deploy) | Befor |