What is an MCP security proxy?
An MCP security proxy is a control point between an AI agent and the Model Context Protocol tools it uses. It inspects the MCP tool calls routed through it, applies configured authentication and policy checks, and can stop a risky call before it reaches the upstream server. Unlike a simple transport bridge, it makes the proposed action visible to an enforcement layer.
In practice, the result depends on the proxy's configuration, active profile, transport, and the calls that are actually routed through it. McpVanguardis ProvnAI's open-source implementation of this pattern.
A model or application submits an MCP tool call.
Configured rules and optional signals inspect the routed call.
The call is forwarded, escalated, or blocked according to policy.
The Problem: MCP Was Built for Capability, Not Defense
The Model Context Protocol (MCP) has become the dominant standard for connecting AI agents to external tools — filesystems, APIs, databases, and shell environments. By mid-2026, public security reporting described large numbers of MCP server instances directly exposed to the internet, along with a small number of high-severity (CVSS 9.x) vulnerabilities in production deployments — figures that vary by source and are difficult to verify independently.
The core architectural issue: MCP was designed for capability, not for defense. It exposes a rich surface of tool calls that an AI agent can invoke on the basis of text instructions alone. When those instructions can be manipulated — via prompt injection, poisoned retrieval context, or malicious MCP server responses — the consequences are not theoretical.
What an MCP Security Proxy Does
An MCP security proxy is an interception layer that sits between the AI agent and the MCP server. MCP tool calls routed through the proxy are inspected before they reach the upstream server. In enforce mode, BLOCK decisions prevent the routed call from reaching the upstream server; in monitor or audit mode, would-block decisions may be logged while traffic continues.
MCP Proxy vs Security Proxy
The word proxy describes where traffic flows; it does not, by itself, describe what the proxy enforces. A routing proxy can connect an agent to an MCP server, while a security proxy adds inspection, authorization, and a policy decision to that path.
This distinction is why deployment details matter: a security proxy only evaluates traffic that is routed through it, and its coverage depends on the configured profile and transport. See the McpVanguard documentation before applying the pattern to a production client.
Real Attack Scenarios
Prompt Injection → Tool Hijacking
An attacker embeds adversarial instructions in a document the agent is summarizing. The instructions redirect the agent to invoke a file-deletion tool on critical system files. Without a proxy, the MCP server may execute the command. With an enforcing proxy, the routed tool call is evaluated against policy and can be blocked before execution.
Prompt Injection — ProvnAI Glossary
SSRF via Tool Parameters
An agent with a web-fetch tool is instructed to target an internal cloud metadata endpoint (169.254.169.254) to exfiltrate IAM credentials. A proxy with configured network destination rules can block common localhost, metadata-service, and private-address targets before the routed request reaches the upstream tool or server.
SSRF — ProvnAI Glossary
Path Traversal in Filesystem Tools
A file-read tool is called with ../../etc/passwd to read sensitive files outside the intended working directory. A proxy can normalize paths and enforce configured containment before the routed request reaches the filesystem server.
Path Traversal — ProvnAI Glossary
Metadata Poisoning
A compromised MCP server returns a poisoned tools/list response with hidden malicious tool definitions. The proxy can inspect configured suspicious metadata patterns before they reach the downstream model.
Tool-Call Hijacking — ProvnAI Glossary
A Five-Layer Defense Architecture
Effective MCP security cannot rely on a single control. The NIST AI Risk Management Framework recommends defense-in-depth for AI systems — multiple independent controls that each reduce risk independently but compound together.
Transport Isolation
MCP servers should never be directly reachable from the internet. Place them behind an authenticated proxy. Enforce mTLS between agent runtime and MCP server.
Deterministic Rule Enforcement
A rules engine at the proxy layer evaluates routed tool calls before execution. Allowlists for permitted tool names and schemas. Pattern matching for known attack signatures.
Semantic Intent Scoring
Rules catch known patterns. When enabled, semantic scoring can evaluate routed tool-call arguments against configured context and policy signals.
Behavioral Monitoring
Track tool call frequency, argument variance, and sequence patterns per session. Rate limits and behavioral anomaly detection catch exfiltration and misuse that rules miss.
Audit and Evidence
Baseline proxies emit structured audit events. Higher-assurance VEX-integrated deployments can preserve selected governed actions as tamper-evident evidence.
How McpVanguard Implements This
McpVanguard is an open-source MCP security proxy built around deterministic enforcement, with optional semantic and session-level controls. It can be introduced without changing existing MCP server implementations and works in both local stdio mode and hosted gateway mode.
Wrap any existing stdio MCP server with vanguard start --server "npx @modelcontextprotocol/server-filesystem ."
Expose hardened SSE and Streamable HTTP endpoints with authentication, JWT validation, and per-client policy enforcement.
Secure your MCP deployment today.
McpVanguard is an open-source security proxy for MCP designed for low-friction deployment in front of existing servers.
MCP Security in Production: The Definitive 2026 Guide
A layer-by-layer guide to securing MCP deployments in production - full attack surface, five-layer defense architecture, and a 10-point readiness checklist.
Why MCP Security Needs Layered Runtime Enforcement
What McpVanguard v2.1.0 changes: preflight normalization, deterministic blocking, camouflage detection, semantic scoring as an advisor, behavioral signals, and explicit policy composition.
MCP Prompt Injection & Tool Poisoning Defenses
How direct and indirect prompt injection reaches MCP tool calls through user input, RAG, and tool results, plus defenses with deterministic policy.
McpVanguard MCP Security Proxy
Open-source MCP security proxy for inspecting tool calls, enforcing policy, and blocking risky actions before execution.