Secure MCP agentsbefore they act.
McpVanguard sits between agents and MCP tools, inspecting routed tool calls before execution, enforcing configurable policy, and emitting structured audit decisions.
Proposed MCP tool call
Unsafe action stopped before upstream execution
Runtime enforcement path
Layered controls let semantic scoring add context without becoming the only thing standing between an agent and a privileged action.
Preflight
Normalize encodings, Unicode, size, depth, and scorer-targeting patterns before deeper inspection.
Rules + Safe Zones
Block known high-risk paths, network destinations, command patterns, and boundary escapes deterministically.
Camouflage
Detect fake approvals, trust labels, policy-waiver language, multilingual reassurance, and scorer-targeting text.
Semantic Advisor
Score ambiguous intent and raise severity when useful. It can escalate, but it cannot downgrade deterministic blocks.
Behavioral / Risk
Track repeated enumeration, suspicious sequences, pacing, and exfiltration-like behavior across the session.
One explicit verdict before execution.
From model intent to policy verdict
When an agent proposes a tool call, McpVanguard turns that moment into an explicit security decision before the upstream MCP server is reached.
- 01
Tool call proposed
- 02
Normalize
- 03
Enforce policy
- 04
Compose verdict
- 05
Execute or block
Five labeled stages, read top to bottom. The stage you are reading highlights as you scroll, and the full path stays visible at rest.
Tool call proposed
The agent asks to call a tool with arguments.
Normalize
Decode, canonicalize, and annotate risky input patterns.
Enforce policy
Apply rules, safe zones, auth context, semantic advice, and risk signals.
Compose verdict
Resolve findings into ALLOW, WARN, REVIEW, SHADOW-BLOCK, or BLOCK.
Execute or block
Allowed calls continue. In enforcing profiles, blocked calls do not reach the upstream server.
Choose your enforcement profile
Start with the profile that matches your operational risk. Strict is powerful, but it is not always the right first step.
Monitor
Safe rolloutAudit-only discovery. See what agents are trying to do before you enforce.
Balanced
Recommended defaultDefault developer enforcement. Blocks high-confidence risks while keeping normal tool workflows moving.
Strict
Production-sensitiveFail-closed semantic behavior, stricter deterministic boundaries, and stronger risk enforcement. Tune for admin and research workflows.
Why layering matters
In historical, corpus-scoped v2.1.0 release research, semantic scoring alone missed cases that deterministic policy caught. The result was an architectural principle: semantic scoring advises; it does not own the boundary.
Malicious cases blocked by semantic scoring alone in this corpus.
Malicious cases blocked by deterministic policy in the same run.
Malicious cases blocked when the layered path was composed.
Install and deploy
Run locally in front of stdio MCP servers, or expose McpVanguard as a hosted SSE / Streamable HTTP gateway with API key or JWT protection.
Commands
pip install mcp-vanguardvanguard start --profile balanced --server "your-mcp-server-command"vanguard sse --profile balanced --server "your-mcp-server-command"vanguard audit-compliancevanguard benchmark-run --profile strictDeployment paths
Local stdio wrapper
Wrap existing MCP server commands without rewriting the server.
Hosted gateway
Expose a protected SSE / Streamable HTTP gateway for remote workflows.
Built for the MCP boundary, not as your only sandbox.
McpVanguard does not replace OS isolation, container boundaries, cloud IAM, or least-privilege tool design. It enforces policy at the MCP execution boundary so proposed tool calls are inspected before they reach real systems.
What is an MCP proxy server?
An MCP proxy server is a middleware layer that sits between an AI agent and its Model Context Protocol (MCP) tools. While some proxies are simply routers or network bridges, a security proxy like McpVanguard inspects MCP tool calls routed through the proxy, applies authorization policies, and can block unsafe routed calls before they reach the upstream server.
What is McpVanguard?
McpVanguard is an open-source, MIT-licensed MCP security proxy that enforces an execution boundary for the Model Context Protocol. It sits between agents and MCP tool servers, normalizes proposed tool calls, applies layered runtime enforcement, and returns an explicit policy verdict before execution.
What attacks does McpVanguard block?
McpVanguard can block high-confidence risks such as path traversal, unsafe filesystem access, SSRF-style network access, suspicious command or tool payloads, metadata poisoning, and policy-boundary violations. Semantic and behavioral layers add context and escalation signals depending on the active profile.
Does McpVanguard rely on an LLM to decide everything?
No. Deterministic rules and safe-zone boundaries carry the primary blocking path. Semantic scoring is optional and advisory: it can raise severity or trigger review, but it cannot silently downgrade deterministic blocks.
How do I install McpVanguard?
Install McpVanguard via pip: run 'pip install mcp-vanguard'. Use 'vanguard start --profile balanced --server <command>' to wrap a local stdio MCP server, or 'vanguard sse --profile balanced --server <command>' to run a hosted gateway. Existing server implementations can usually remain unchanged; verify the client configuration and transport before rollout.
Is McpVanguard free to use?
Yes. McpVanguard is open source under the MIT license and free to use in personal and commercial projects. The source code is available on GitHub at github.com/provnai/McpVanguard.
Does McpVanguard require changes to existing MCP servers?
Usually no. McpVanguard wraps existing MCP servers and enforces policy before calls reach them. Production deployments should tune safe zones, profiles, auth policy, and allowlists to match the tools being protected.
The Model Context Protocol - the open standard McpVanguard helps secure when traffic is routed through it.
Adversarial text that redirects agent behavior before unsafe tool calls are inspected at runtime.
Unauthorized tool invocation constrained by McpVanguard's policy enforcement boundary.
Agent-driven exploitation of internal services constrained by destination policy and safe-zone boundaries.
Filesystem escape via relative paths normalized and blocked at the execution boundary.
Rule-based, non-probabilistic enforcement - the primary path for known MCP hazards.
The formally defined perimeter that McpVanguard enforces for routed MCP sessions.
Routed MCP tool calls are evaluated independently - McpVanguard's core security philosophy.