bastiongate
gateRuntime MCP security gateway
MCP security gateway: an inline proxy that drops poisoned tools, enforces allow/deny, blocks injected results, and catches the lethal trifecta across a session.
pip install bastiongateway The PyPI package is bastiongateway; the import package and CLI are bastiongate. The flow guard and the encoded-result check ship in warn (shadow) mode; taint is per server unless gates share a taint_group (opt-in, stdio).
What it does
- Sits inline between agent and MCP servers (stdio + HTTP/SSE)
- Drops poisoned tools, enforces allow/deny, blocks injected results, redacts PII in arguments
- Scans everything the model can read: tool results, embedded resources and files, resources/read, prompts, resource and prompt lists, server errors and the server’s own instructions
- Encoded injection in results (base64, hex, binary, Morse...): warn by default, block with on_encoded_result; rot13 / leetspeak / reversed text opt-in
- Flow guard: warns about (or blocks) a tool call that sends data out after the session read untrusted content and private data, the GitHub MCP toxic flow; taint_group extends it across MCP servers (fetch, then filesystem, then fetch)
- Emits OpenTelemetry GenAI execute_tool spans with each verdict (--otel-out / --otel-endpoint), ready for any OTLP backend or bastiontrace
- Label packs for common servers (GitHub, filesystem, fetch, Slack, Gmail); JSONL forensic log; consumes the policy bastionsupply harden emits; optional deep inspection via agentbastion
Quickstart
bastiongate run --policy policy.yaml -- my-mcp-server
python -m bastiongate.demo # replays the GitHub toxic flow
bastiongate run --otel-out spans.jsonl -- my-mcp-server
bastiongate labels --policy policy.yaml tools.json
Version 0.13.0 · MIT