Jimil-Joshi/blastradius-mcp

**A zero-trust security proxy for Model Context Protocol servers.** It resolves each
agent tool call the way the shell will, scores it 0-100 *before* it runs, blocks the
dangerous ones, redacts credentials flowing in either direction, requires a signed
human approval token for high-impact actions, detects multi-step attack sequences, and
leaves a tamper-evident audit trail.
Apache-2.0. Two runtime dependencies. Runs locally, opens no sockets, phones
nothing home, no license key and no paid tier.
---
The problem
Give an agent bash, filesystem, SQL, or cloud access through MCP and you have
handed a language model the ability to run rm -rf, DROP TABLE, or
aws s3 rb. Those are not hypotheticals, they are the first thing anyone writes
in a demo. Meanwhile:
- Tool inputs and outputs carry unmasked AWS keys, GitHub PATs, and database passwords.
- Nothing simulates the consequences before the call lands.
- Nothing records that the call happened, so nothing can be reviewed afterwards.
Existing options ask you to route every call through a hosted control plane, or to
rewrite your agent loop. BlastRadius sits in front of the MCP server instead. Your
agent's loop does not change.
And the second problem: matching the text is not the same as matching the command
This is the one that gets products like this wrong.
A guardrail matches the submitted string. The shell executes the *resolved*
string. Bash rewrites the text first, through quote removal, parameter expansion,
command substitution, and pipeline assembly. So these are the same command to the
kernel and completely different strings to a regex:
A guard evaluating the pre-transformation string and a shell executing the
post-transformation string are evaluating **two different commands**.
This is not a hypothetical concern. The **GuardFall** survey, published 30 June
2026, tested the pre-execution command guards in eleven actively maintained coding
agents spanning roughly 548,000 GitHub stars. Agents whose guard regexes the raw
command string leaked on the large majority of bypass cases attempted against them.
Goose leaked on 22 of 23. OpenCode on 16 of 16. Only **Continue**, which tokenizes
with shell-aware parsing and resolves expansion and substitution *before* matching
the fully resolved command, blocked all twenty-one cases.
So this engine resolves first, then matches. See
Seeing past the bypass.
---
Install
Requires Node 22+. That is the whole install.
Standalone
Run it as its own MCP server and call its tools from your agent.
Proxy mode
Wrap an existing server. Nothing downstream changes.
Working configs for Cursor, Cline, and VS Code are in examples/.
Installable as a one-click local MCP bundle via manifest.json.
---
Real output
Every block below was produced by running the engine, not written by hand.
Regenerate them yourself with node scripts/generate-readme-transcripts.mjs.
Scoring a destructive action
The same command, different environment
Score 95 on staging. **100** when the context says production.
A read is not a risk
Redacting credentials on the way in
The policy gate blocks
Step-up approval, and the replay it prevents
The same call three times: no token, valid token, same token again.
That third block is the whole point. An approval token authorises exactly one
action.
---
The six tools
| Tool | What it does |
| :--- | :--- |
| simulate_action | Scores an action 0-100 before execution, reports severity, affected entities, and whether rollback is possible |
| inspect_payload_dlp | Finds and redacts secrets and PII in any text |
| enforce_policy | The decision point. Returns ALLOW, BLOCK, or REQUIRE_CONFIRMATION, plus the rule that fired |
| request_confirmation_token | Issues a signed, single-use, tool-scoped approval token |
| verify_audit_log | Re-walks the hash chain and its signatures to detect tampering |
| get_security_posture | Live metrics, active policy, build capabilities |
---
Seeing past the bypass
src/analyzer/shellResolver.ts resolves a command
the way a POSIX shell would, to the extent that is possible **without executing
anything**. The rule patterns then run against what the shell would actually run.