verified_user Apache 2.0 Open Source

Secure AI Tool Ecosystems with MCPIDS

MCPIDS is an inline security layer for Model Context Protocol deployments. It inspects every request and response, detects prompt injection and secret leakage, and applies policy decisions before risky tool behavior reaches production agents.

shield Prompt injection defense
key_off Secret leak prevention
rule Policy-driven enforcement
smart_toy AI Agent
security
shield_with_heart MCPIDS
dns MCP Server
INSPECTION_LOG STATUS: ALLOW
[INFO] Intercepting JSON-RPC request...
[INFO] Rules match score: 0.01
[INFO] Secret scan: clean
[INFO] Policy set: default.yaml
[PASS] Forwarded to destination.

Timeout Default

100ms

Default fail-closed pipeline timeout

Scenario Fixtures

8

Bundled scenario fixtures

Core Components

5

Gateway, control plane, agent, semantic service, sensor

The Unchecked Autonomy Problem

"As AI agents move from chat interfaces to autonomous tool execution, the attack surface expands rapidly. Without inline inspection, trusted MCP connections become a path for jailbroken logic, credential exposure, and cross-system exfiltration."

RISK_01

Indirect Prompt Injection

Malicious instructions hidden in external content can pressure agents into unauthorized tool calls and unsafe reasoning paths.

RISK_02

Secret Leakage

Tool responses and prompt context can accidentally expose API keys, tokens, tenant data, or system secrets to downstream models.

Precision Guardrails

Deep inspection for every request and response moving through your MCP ecosystem, with policy-backed decisions that remain explainable.

Repository-Aligned Features
visibility

Traffic Inspection

Inspects MCP JSON-RPC messages flowing between agents and servers.

gpp_maybe

Injection Detection

Rules and semantic analysis detect adversarial prompts and jailbreak-style instructions.

no_encryption

Secret Prevention

PII and credential signatures are scanned before content reaches agents or LLM providers.

rule

Policy Enforcement

Fine-grained policy rules restrict tool use by action, path, context, risk, or tenant.

analytics

Risk Scoring

Every transaction gets a weighted risk score across rules, semantic, diff, and graph signals.

history_edu

Audit Trails

Append-only audit records for compliance reviews, incident response, and forensics.

schema

Schema Detection

Silent tool definition changes are flagged before widened capabilities escape review.

approval_delegation

Approval Flows

High-risk actions can be held for human approval before writes, exfiltration, or destructive changes.

Real-Time Inspection and Policy Enforcement

Inline proxying by routing clients through the gateway or wrapping stdio agents.

01

Intercept

MCPIDS receives the JSON-RPC call as lightweight middleware and proxies the transport stream.

02

Analyze

Rules, semantic classifiers, and secret scans inspect intent, content, and known threat patterns.

03

Evaluate

Signals are aggregated into risk scores and matched against policy decisions for each tenant and tool.

04

Route

Safe traffic is forwarded. Unsafe traffic is blocked, redacted, quarantined, or held for approval.

policies/default.yaml
# Redact secrets in tool call responses
id: policy-redact-secrets
priority: 20
scope:
methods: [tools/call]
directions: [outbound]
conditions:
- field: "result.text"
op: secret_pattern
action:
decision: redact
severity: critical

Designed for Every Agent Journey

code

Secure AI Coding Agents

Detect destructive shell-style tool requests and suspicious multi-step exfiltration patterns in agent sessions.

corporate_fare

Enterprise Agent Workflows

Enforce data boundaries even when agents orchestrate tools across departments and systems.

monitoring

Ecosystem Monitoring

Observe tool execution patterns to detect lateral movement, schema drift, and shadow IT behavior.

health_and_safety

Guardrails for Autonomy

Set hard limits on risky tools, outbound destinations, and sensitive paths before autonomous loops spiral.

Threat Fixtures

check_circle

8 bundled scenarios

Covered by repository tests and fixtures

Decision Precedence

quarantine > deny > require_approval > redact > hide > monitor_only > allow

Most restrictive decision wins when multiple interceptors contribute signals

Representative Outcomes

Tool response contains an injected prompt redact
Tool schema widens after a server update require approval
`read_secrets` chains into `post_to_webhook` in the same session quarantine

Developer Quick Start

Local development uses Go, Docker, and Make. For the fastest demo, run the bundled script. For a fuller setup, follow the same `make`-based flow documented in the README and local development guide.

EXTENSIBLE

Tenant-Scoped Policy Rules

NATIVE

Go Gateway and Control Plane

SECURE

Gateway TLS, optional control-plane mTLS

FAST

100ms default fail-closed timeout