LabscoMCP early access ↗
provnaiMCP SERVER · OFFICIAL PROJECT

McpVanguard

A policy gateway that sits between an agent and an MCP server, inspecting every tool call and blocking unsafe file, shell and network patterns before they land.

by provnai ↗Agent Guardrails, Content Safety & Audit✓ Official

LABSCO SUMMARY

Enforcement you can adopt one workflow at a time.

The profile ladder is the practical part: run monitor to see what your agents actually do, move to balanced, and reserve strict for the systems where a wrong call costs something. The project is explicit about what its safe zones are not — path-boundary checks, not OS sandboxing or container isolation — so pair it with real isolation rather than treating it as a replacement, and keep the native vanguard_* management tools disabled or operator-only in production.

What it is

A security gateway for MCP traffic. It wraps an existing stdio server, or runs as a hosted gateway over SSE and Streamable HTTP, and inspects each tool call before it reaches the tool underneath. Existing servers do not need rewriting; you point the gateway at the command you were already launching. Three profiles — monitor, balanced, strict — let you start in audit-only mode and tighten later.

What you get

  • Every call run through five inspection layers before it is forwarded: L0 preflight normalisation (URL decode, NFKC, zero-width stripping, size and depth gates), L1 deterministic rule matching, L1.5 trust-signal camouflage detection, L2 optional semantic intent scoring, L3 session and sequence anomaly checks
  • A final verdict per call from the policy composer — ALLOW, WARN, REVIEW, SHADOW-BLOCK or BLOCK — with the blocked call returned to the agent as a standard JSON-RPC error the upstream server never sees
  • Metadata poisoning inspection on initialize and tools/list, so a hostile tool description is caught before the model reads it
  • Deterministic path-boundary checks over path-like arguments, tuned in rules/safe_zones.yaml for the directories your tools may touch
  • JSON audit logs with SIEM-friendly decision fields and a policy_explanation block naming the layer, rule family, profile effect, upstream-call status and a tuning hint
  • A local dashboard, a compliance check and packaged benchmark corpora you can run per profile — vanguard ui --port 4040, vanguard audit-compliance, vanguard benchmark-run --profile monitor

Requirements

Python 3.11+ and pip install mcp-vanguard; extras add Redis-backed multi-instance behavioural state, RE2 regex matching, or the full hosted deployment. Local use needs no network auth — vanguard start --profile balanced --server "..." wraps the server you name. Hosted use does: the strict profile refuses to start on a public bind without transport auth, meaning a long random VANGUARD_API_KEY or OAuth/JWKS settings, and balanced will warn loudly instead. If you run a shared gateway, set VANGUARD_ALLOWED_SERVER_COMMANDS to restrict which upstream executables it may spawn. The optional semantic layer takes a backend key — VANGUARD_OPENAI_API_KEY, VANGUARD_SEMANTIC_CUSTOM_KEY, or VANGUARD_OLLAMA_URL for a local model with no key at all.

Setup effort

One command — pip install mcp-vanguard

See installation options