behrensd/mcp-firewall

**iptables for MCP.** Blocks dangerous tool calls, scans for secret leakage, logs everything. No AI, no cloud, pure rules.
Sits between your AI coding tool (Claude Code, Cursor, Windsurf) and MCP servers, intercepting every JSON-RPC message and enforcing YAML-defined policies.
Why
MCP servers have full access to your filesystem, shell, databases, and APIs. When an AI agent calls tools/call, the server executes whatever the agent asks — reading SSH keys, running rm -rf, exfiltrating secrets. There's no built-in policy layer.
mcpwall adds one. It's a transparent stdio proxy that:
- **Blocks sensitive file access** — .ssh/, .env, credentials, browser data
- **Blocks dangerous commands** — rm -rf, pipe-to-shell, reverse shells
- **Scans for secret leakage** — API keys, tokens, private keys (regex + entropy)
- **Scans server responses** — redacts leaked secrets, blocks prompt injection patterns, flags suspicious content
- **Logs everything** — JSON Lines audit trail of every tool call and response
- **Uses zero AI** — deterministic rules, no LLM decisions, no cloud calls
- **Test rules without running the proxy** — mcpwall check gives instant pass/fail on any tool call
Install
Or use directly with npx:
Quick Start
Option 1: Docker MCP Toolkit
If you use Docker MCP Toolkit (the most common setup), change your MCP config from:
To:
That's it. mcpwall now sits in front of all your Docker MCP servers, logging every tool call and blocking dangerous ones. No config file needed — sensible defaults apply automatically.
Option 2: Interactive setup
This finds your existing MCP servers in Claude Code, Cursor, Windsurf, and VS Code configs and wraps them. Optionally pick a security profile:
Option 3: Manual wrapping (any MCP server)
Change your MCP config from:
To:
Option 4: Wrap a specific server
How It Works
**Inbound** (requests):
1. Intercepts every JSON-RPC request on stdin
2. Parses tools/call requests — extracts tool name and arguments
3. Walks rules top-to-bottom, first match wins
4. **Allow**: forward to real server
5. **Deny**: return JSON-RPC error to host, log, do not forward
**Outbound** (responses):
1. Parses every response from the server before forwarding
2. Evaluates against outbound_rules (same first-match-wins semantics)
3. **Allow**: forward unchanged
4. **Deny**: replace response with blocked message
5. **Redact**: surgically replace secrets with [REDACTED BY MCPWALL], forward modified response
6. **Log only**: forward unchanged, log the match
Configuration
Config is YAML. mcpwall looks for:
1. ~/.mcpwall/config.yml (global)
2. .mcpwall.yml (project, overrides global)
If neither exists, built-in default rules apply.
Example config
mcpwall does not support an interactive ask action; choose allow or deny explicitly.
Rule matchers
| Matcher | Description |
|---------|-------------|
| regex | Regular expression test on the value |
| pattern | Glob pattern (uses minimatch) |
| not_under | Matches if path is NOT under the given directory. Supports ${HOME}, ${PROJECT_DIR} |
| secrets | When true, runs the secret scanner on the value |
The special key _any_value applies the matcher to ALL argument values.
Outbound rules (response inspection)
Outbound rules scan server responses before they reach your AI client. Add them to the same config file:
Outbound matchers