MCP-Bastion

Enterprise-Grade Security Middleware for the Model Context Protocol

Releases are published to npm, PyPI, and prebuilt Docker images on GitHub Container Registry (ghcr.io/vaquarkhan/mcp-bastion-proxy, ghcr.io/vaquarkhan/mcp-bastion-dashboard) — pull/run details in DOCKER.md — via GitHub Actions on tag push.

Documentation: structured paths for policy and LLM integration live in docs/README.md and docs/index.md. Community: open a GitHub Issue for bugs or gaps, a Discussion for integration questions (if enabled on the repo), or a PR for docs and examples—those help every adopter.

Hello world (minimal Bastion on code): see docs/QUICK_START.md — FastMCP helper secure_fastmcp(mcp) (wires MCPBastionMiddleware into tool dispatch), or two-line build_middleware_from_config() for full bastion.yaml policy, plus a CI validate snippet for pipeline-driven installs.

The Model Context Protocol (MCP) has rapidly become the universally accepted standard for connecting AI agents to enterprise databases and APIs. However, this connectivity introduces a massive new attack surface: unpredictable, non-deterministic agentic behavior.

MCP-Bastion is a lightweight, drop-in security middleware designed to wrap around any existing Python or TypeScript MCP server. Instead of relying on passive logging, human-in-the-loop approvals, or third-party APIs, MCP-Bastion provides an active, 100% local defense layer. It intercepts standard JSON-RPC traffic to stop threats before they cross the enterprise boundary.

Under 5ms proxy overhead. MCP-Bastion provides:

• Prompt Injection Defense: Meta PromptGuard runs locally to block adversarial payloads and jailbreaks.
• PII Redaction: Uses Microsoft Presidio to detect and mask PII before it reaches the LLM context.
• Infinite Loop Protection: Token buckets and cycle detection stop runaway agents from burning API budget.

Secure your MCP server without changing business logic.

Core Features

Zero-Click Prompt Injection Prevention

Integrates Meta's PromptGuard model locally to detect and block malicious payloads, jailbreaks, and adversarial tokenization before they reach your external tools.

PII Redaction

Microsoft Presidio scans outbound tool results and masks PII (redaction, substitution, generalization).

Infinite Loop and Denial of Wallet Protection

Implemen

... View full README on GitHub