MCP-Bastion · vaquarkhan — Claude Code MCP server: guardrails for agents
A local guardrail layer for MCP: blocks prompt injection, strips PII and caps token spend. Useful when your agent touches databases, APIs and shell tools.
claude mcp add mcp-bastion -- uvx mcp-bastion-pythonWhat MCP-Bastion does
MCP-Bastion sits around your MCP server and applies local limits. It inspects tool definitions, redacts personal data, stops instruction smuggling through prompts, and tracks token usage so a runaway loop does not drain your API budget. It ships as a library rather than a gateway and calls no third-party safety service.
Three phases make up the workflow. Scanning statically checks a tool-definition file for injections, secrets, lookalike characters and weak schemas. Auditing produces a risk report on the local MCP client config: over-broad tool permissions, standing credentials, filesystem servers. Enforcement then runs in-process, for instance blocking a session secret or PII value from reaching a tool whose arguments are URLs or emails.
Startup goes through uvx mcp-bastion-python, so uv has to be on the machine. Rules live in bastion.yaml. With an empty config the server still starts, but nothing gets blocked — that file is the first thing to fill in.
What it helps with
- block a prompt injection before the tool call fires
- strip PII and secrets out of MCP responses
- catch poisoned tool descriptions during a static scan
- cap output token spend so a loop cannot burn the API budget
- review a local MCP client config for over-broad permissions
Example prompts for the agent
- Scan
tools.jsonwith MCP-Bastion for injections and secrets - Run an audit of my local MCP client config risks
- Turn on blocking of PII flowing into tools with URL and email arguments
How to install MCP-Bastion
Platform CLI
claude mcp add mcp-bastion -- uvx mcp-bastion-pythonuvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>
Platform CLI
codex mcp add vaquarkhan-mcp-bastion -- uvx mcp-bastion-pythonuvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>
Config file
{
"mcpServers": {
"vaquarkhan-mcp-bastion": {
"command": "uvx",
"args": [
"mcp-bastion-python"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>
Config file
{
"servers": {
"vaquarkhan-mcp-bastion": {
"type": "stdio",
"command": "uvx",
"args": [
"mcp-bastion-python"
]
}
}
}uvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>
Platform CLI
gemini mcp add vaquarkhan-mcp-bastion uvx mcp-bastion-pythonuvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about MCP-Bastion
How do I install MCP-Bastion in Claude Code?
Run claude mcp add mcp-bastion -- uvx mcp-bastion-python. That registers the server with Claude and launches it through uvx.
What does MCP-Bastion do?
It wraps an MCP server in local guardrails: injection blocking, PII redaction, supply-chain checks and token caps. No external safety API is involved.
What do I need before running it?
uv installed, since the server starts via uvx mcp-bastion-python, plus a bastion.yaml with your rules.
Similar MCP servers
Everything for Security →MCP-Bastion by other authors comes first.
