# mcp-armor

Intercepts MCP client traffic to block prompt injections, poisoned tool schemas, and tampered manifests.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 1
- Author: studiomeyer-io
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/studiomeyer-io/mcp-armor
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/mcp-armor

## What it does

The server runs as an inline security proxy between an MCP client and upstream processes. All JSON-RPC communication flows through a four-stage pipeline. It executes Aho-Corasick matching, regex evaluation, zero-width character stripping, and homoglyph normalization. Before spawning child servers, it unsets loader environment variables such as `LD_PRELOAD` and `NODE_OPTIONS`.

The sidecar inspects tool catalogs to catch prompt injections embedded directly inside parameter descriptions. It flags directory traversal patterns and checks Ed25519 manifest signatures against a local TOFU keystore. An internal control server provides 11 read-only tools so the client can inspect blocked payloads stored in memory.

Compiling from source demands Rust 1.89 or later because modern dependency crates fail on older toolchains. Running the official Docker container removes any need to manage local compiler versions.

## Requirements
- Needs: Docker

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mcp-armor -- docker run -i --rm ghcr.io/studiomeyer-io/mcp-armor:0.8.1
```

### Codex

**Platform CLI**
```bash
codex mcp add mcp-armor -- docker run -i --rm ghcr.io/studiomeyer-io/mcp-armor:0.8.1
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "mcp-armor": {
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/studiomeyer-io/mcp-armor:0.8.1"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "mcp-armor": {
            "type": "stdio",
            "command": "docker",
            "args": [
                "run",
                "-i",
                "--rm",
                "ghcr.io/studiomeyer-io/mcp-armor:0.8.1"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add mcp-armor docker run -i --rm ghcr.io/studiomeyer-io/mcp-armor:0.8.1
```

## When to use it
- block prompt injection payloads hidden in tool arguments and schemas
- strip dangerous loader environment variables before spawning processes
- detect homoglyph evasion and ANSI escape sequences in JSON-RPC calls
- verify server manifest integrity using Ed25519 signatures and Sigstore

## Example prompts
- Inspect the recent security blocks using armor_scan_payload.
- Check the registered tools for prompt injections hidden in their parameter schemas.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md