# MCP-Bastion

A local guardrail layer for MCP: blocks prompt injection, strips PII and caps token spend. Useful when your agent touches databases, APIs and shell tools.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 7
- Author: vaquarkhan
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/vaquarkhan/MCP-Bastion
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/vaquarkhan-mcp-bastion

## What it does

MCP-Bastion sits around your MCP server and applies local limits. It inspects tool definitions, redacts personal data, stops instruction smuggling through prompts, and tracks token usage so a runaway loop does not drain your API budget. It ships as a library rather than a gateway and calls no third-party safety service.

Three phases make up the workflow. Scanning statically checks a tool-definition file for injections, secrets, lookalike characters and weak schemas. Auditing produces a risk report on the local MCP client config: over-broad tool permissions, standing credentials, filesystem servers. Enforcement then runs in-process, for instance blocking a session secret or PII value from reaching a tool whose arguments are URLs or emails.

Startup goes through `uvx mcp-bastion-python`, so `uv` has to be on the machine. Rules live in `bastion.yaml`. With an empty config the server still starts, but nothing gets blocked — that file is the first thing to fill in.

## Requirements
- Needs: Python and uv (commands run via uvx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mcp-bastion -- uvx mcp-bastion-python
```
uvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>

### Codex

**Platform CLI**
```bash
codex mcp add vaquarkhan-mcp-bastion -- uvx mcp-bastion-python
```
uvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "vaquarkhan-mcp-bastion": {
            "command": "uvx",
            "args": [
                "mcp-bastion-python"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "vaquarkhan-mcp-bastion": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "mcp-bastion-python"
            ]
        }
    }
}
```
uvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add vaquarkhan-mcp-bastion uvx mcp-bastion-python
```
uvx runs the command named after the package; if the README names another one, use uvx --from mcp-bastion-python <command>

## When to use it
- block a prompt injection before the tool call fires
- strip PII and secrets out of MCP responses
- catch poisoned tool descriptions during a static scan
- cap output token spend so a loop cannot burn the API budget
- review a local MCP client config for over-broad permissions

## Example prompts
- Scan `tools.json` with MCP-Bastion for injections and secrets
- Run an audit of my local MCP client config risks
- Turn on blocking of PII flowing into tools with URL and email arguments

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

## Other versions with the same name
- [mcp-bastion · gowthaman90](https://affpapa.org/en/nevibecode/mcp/mcp-bastion.md) — ★ 7

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md