v0.2.1

mcp-runtime-authz is a firewall between an MCP client (Claude Code, Claude Desktop, Cursor) and the MCP servers it uses. It checks every tool call before it runs.

This release changes no policies and no command-line behaviour. It tests claims that were previously only stated, and documents the security model.

Tested, not just claimed

• Fail-closed audit log. A new test puts the audit log on /dev/full, a device where every write fails, and checks that allowed and escalated calls are refused and never run.
• Published results. A new test runs the full evaluation and fails if the numbers in report/findings.md stop holding: 7/7 attacks blocked, 0/6 false positives, and exactly two rules whose removal lets an attack through.
• Coverage. CI measures line coverage (86%) and fails below 80%.
• Reproducible builds. CI builds the release binary twice from clean and fails unless the two are bit-for-bit identical.

Hardening

• Release builds keep integer overflow checks.
• The decision path keeps the session's history and taint data even if an internal lock is poisoned, instead of dropping them, which would have failed open. This could not happen in practice; the fix is defensive.

Docs

• Security model and assurance case: what the guard guarantees and how each guarantee is tested, what it does not promise, the threat model, trust boundaries, and a table of common weaknesses (CWE) and their countermeasures.
• Architecture, governance, code of conduct, roadmap, and a reference for every command and file format.
• The project holds the OpenSSF Best Practices passing badge.

No vulnerabilities were fixed in this release.

Verify a download:

gh attestation verify <archive> --repo Wazza0/mcp-runtime-authz

v0.2.0: init, tool pinning, fetch and git policies, signed provenance

mcp-runtime-authz is a firewall between an MCP client (Claude Code, Claude Desktop, Cursor) and the MCP servers it uses. It checks every tool call before it runs.

New

• authz init -- <server> drafts a policy from a server's real tool list. It classifies each tool and adds the rules that fit. When unsure it fails safe: tools it can't classify, and tools the server calls destructive, start refused.
• Tool pinning (--pin tools.lock). A tool whose definition changes after you trust it, or a new tool, is hidden from the agent and refused until you accept the change with --repin.
• authz audit audit.jsonl shows the audit log as a readable table.
• Starter policies for the official fetch and git servers, each verified end to end against the real server:
  • fetch: only hosts you list; localhost, private and cloud-metadata addresses are refused even if listed; no credentials or keys in URLs.
  • git: credential files can't be staged or read back from history; sweeping pathspecs are refused; no secrets in commit messages.

Fixed

• Windows paths walked past filesystem.yaml. A shell had silently turned [\\/] into [\/], which matches forward slashes only, so C:\p\.env was allowed. If you use filesystem.yaml on Windows, update it.
• A URL's login part posed as its host. http://allowed.test:x@evil.test/ passed the host check as allowed.test. Hosts are now parsed properly, and where URL parsers disagree, every possible host must be allowed.

Supply chain

• Signed build provenance. Each archive ships with a .sigstore.json bundle. Verify a download with:

  gh attestation verify <archive> --repo Wazza0/mcp-runtime-authz

• CI checks:
  • every dependency against the RustSec advisory database (cargo-deny)
  • fuzzing of the decoder, the policy loader and the decision path
  • property tests
  • CodeQL on the code and the workflows
  • all actions pinned to exact commits, with an OpenSSF Scorecard published

Found a way past it? Report it privately via SECURITY.md.

v0.1.0: MCP firewall proxy

First release of mcp-runtime-authz: a firewall that sits between an MCP client (Claude Code, Claude Desktop, Cursor) and the MCP servers it uses, and checks every tool call before it runs.

Install

Download the archive for your platform below, check it against its .sha256 file, unpack, and run authz proxy. Each archive includes the binary, both starter policies and the licenses.

authz proxy --policy policies/filesystem.yaml --audit audit.jsonl \
  -- npx -y @modelcontextprotocol/server-filesystem /path/to/project

Setup for Claude Code and other clients is in the README.

What's in it

• Proxy for any stdio MCP server, with full pass-through of tool results and a write-ahead audit log.
• Starter policy for the official filesystem server: credential files stay unreadable, secrets can't be written into files, and nothing can be written to paths that run code later (git hooks, CI workflows, editor tasks, shell rc files).
• Secret and taint detection that decodes arguments and searches inside lists and objects before matching.
• Compile-time guarantee that no code path runs a tool without passing the check.
• Refusals that reveal nothing to the agent beyond BLOCKED and an audit reference.

Measured, with caveats

On a small, self-written corpus, it blocked every attack that worked without it (7/7 with a scripted agent, 3/3 with qwen3:8b) and broke none of the 6 benign tasks. The corpus is small and the same author wrote the attacks and the rules, so read this as a demonstration, not proof of generality. Full results and limitations: report/findings.md.

Found a way past it? Please report it privately: see SECURITY.md.