trailofbits/mcp-context-protector

## Overview
mcp-context-protector is a security wrapper for MCP servers that addresses risks associated with running untrusted MCP servers, including line jumping, unexpected server configuration changes, and other prompt injection attacks. Implementing these security controls through a wrapper (rather than through a scanner that runs before a tool is installed or by adding security features to an MCP host app) streamlines enforcement and ensures universal compatibility with all MCP apps.
## Features
Trust-on-first-use pinning of server configurations
Automatic blocking of unapproved configuration changes
Guardrail scanning and quarantining of tool responses
ANSI control character sanitization
Assisted editing of mcp.json files
## Quickstart
Installation:
# Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh
# Download mcp-context-protector
git clone https://github.com/trailofbits/mcp-context-protector
# Install dependencies
cd mcp-context-protector
uv sync
To make it easier to launch mcp-context-protector, we recommend updating mcp-context-protector.sh to contain the full path to uv. Some MCP clients, including Claude Desktop, replace the PATH environment variable with a minimal set of paths when launching MCP servers, which can make your claude_desktop_config.json file unwieldy and hard to maintain. Including a full path to uv in the launcher helps mitigate this problem.
Now configure your client to run your MCP servers through mcp-context-protector, and tool configuration pinning will automatically be enabled. Here's a sample Claude Desktop config:
"mcpServers": {
"wrapped_acme_server": {
"command": "/path/to/mcp-context-protector/mcp-context-protector.sh",
"args": ["--command", "/path/to/node /path/to/acme/server.js"]
Alternatively, use --command-args to have mcp-context-protector concatenate all arguments that follow into one command string:
"mcpServers": {
"wrapped_acme_server": {
"command": "/path/to/mcp-context-protector/mcp-context-protector.sh",
"args": ["--command-args", "/path/to/node", "/path/to/acme/server.js", "--acme-enhanced"]
TL;DR: use --command-args if your MCP client mangles your stdio server command, but be careful with escaping of shell metacharacters.
Longer explanation: Some clients (including, as of this writing, Cursor) will construct their MCP server commands by concatenating the arguments together into a space-delimited string. That is, mcp-context-protector.sh --command "cmd arg1 arg2 --arg3" will become mcp-context-protector.sh --command cmd arg1 arg2 --arg3, and mcp-context-protector will think arg1 through --arg3 are meant as arguments to the wrapper, not to the child command. The --command-args option addresses this issue.
## Security risks and controls
| Risk | Relevant control |
| Line jumping | Server configuration blocking, approval and pinning; guardrail evaluation of server instructions and tool descriptions |
| Server configuration changes/rug pulls | Server configuration pinning |
| User deception through ANSI control characters | ANSI control character sanitization |
| Other prompt injection attacks | Tool response guardrails and quarantining |
## Server configuration pinning