v0.1.0: MCP firewall proxy

First release of mcp-runtime-authz: a firewall that sits between an MCP client (Claude Code, Claude Desktop, Cursor) and the MCP servers it uses, and checks every tool call before it runs.

Install

Download the archive for your platform below, check it against its .sha256 file, unpack, and run authz proxy. Each archive includes the binary, both starter policies and the licenses.

authz proxy --policy policies/filesystem.yaml --audit audit.jsonl \
  -- npx -y @modelcontextprotocol/server-filesystem /path/to/project

Setup for Claude Code and other clients is in the README.

What's in it

• Proxy for any stdio MCP server, with full pass-through of tool results and a write-ahead audit log.
• Starter policy for the official filesystem server: credential files stay unreadable, secrets can't be written into files, and nothing can be written to paths that run code later (git hooks, CI workflows, editor tasks, shell rc files).
• Secret and taint detection that decodes arguments and searches inside lists and objects before matching.
• Compile-time guarantee that no code path runs a tool without passing the check.
• Refusals that reveal nothing to the agent beyond BLOCKED and an audit reference.

Measured, with caveats

On a small, self-written corpus, it blocked every attack that worked without it (7/7 with a scripted agent, 3/3 with qwen3:8b) and broke none of the 6 benign tasks. The corpus is small and the same author wrote the attacks and the rules, so read this as a demonstration, not proof of generality. Full results and limitations: report/findings.md.

Found a way past it? Please report it privately: see SECURITY.md.