mcpwall — Claude Code MCP server: what it does, how to install
Local firewall proxy for MCP servers. It inspects tool calls, stops dangerous shell executions, and redacts leaked credentials.
claude mcp add mcpwall -- npx -y mcpwallWhat mcpwall does
The proxy sits directly on stdio between your development environment and MCP servers. Every JSON-RPC message gets checked against rules defined in .mcpwall.yml or global settings. When an agent attempts to inspect .ssh/ folders, read .env secrets, or run destructive commands like rm -rf, the proxy stops the request and returns an error.
Responses traveling back from MCP servers undergo inspection as well. Detected API keys or credentials get replaced with [REDACTED BY MCPWALL]. Every request and response is appended to a JSON Lines log. The system runs without language models, relying purely on regular expressions and entropy calculations.
You can test rule matching offline via mcpwall check. Applying strict security settings to existing environments is possible through npx mcpwall init --profile strict.
What it helps with
- prevent AI agents from reading SSH keys and credential files
- block destructive shell actions such as
rm -rf - redact API tokens and private keys from tool outputs
- maintain a JSON Lines audit log of every tool execution
Example prompts for the agent
- Run
npx mcpwall checkto test our policy against file access - Initialize security wrapping with
npx mcpwall init --profile strict - Wrap our Docker MCP gateway using
npx -y mcpwall -- docker mcp gateway run
How to install mcpwall
Platform CLI
claude mcp add mcpwall -- npx -y mcpwallPlatform CLI
codex mcp add mcpwall -- npx -y mcpwallConfig file
{
"mcpServers": {
"mcpwall": {
"command": "npx",
"args": [
"-y",
"mcpwall"
]
}
}
}Config file
{
"servers": {
"mcpwall": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"mcpwall"
]
}
}
}Platform CLI
gemini mcp add mcpwall npx -y mcpwallStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about mcpwall
How to install mcpwall in Claude Code?
Run claude mcp add mcpwall -- npx -y mcpwall in your terminal. This registers the proxy command inside your environment.
What does mcpwall do?
It acts as an intercepting firewall for MCP calls. It enforces YAML rules against incoming tool arguments, redacts secrets from responses, and logs all traffic.
Does mcpwall require an AI model or cloud service?
No. All inspections happen locally using deterministic rules, regex matching, and entropy thresholds without any cloud communication.
