Boundary

Boundary is a local MCP security firewall. It runs between an AI agent and MCP servers, inspects tool calls, enforces least-privilege policy, records audit events, flags prompt-injection attempts, and fails CI when MCP configs are unsafe.

What it shows

• Stdio and Streamable HTTP MCP proxies that block dangerous tool calls before they reach an upstream server.
• YAML policy language for allow/deny rules, read-only filesystem access, shell denial, and prompt-injection handling.
• SQLite audit log for every allow/deny decision and detected prompt-injection finding.
• Malicious tool demo with controlled secret-read, shell, and prompt-injection scenarios.
• Simple shadcn/Tailwind audit dashboard.
• GitHub Action that fails CI for unsafe Claude Desktop or Cursor MCP configs.

Quick start

pnpm install
cargo test
pnpm --filter @boundary/dashboard dev

In another terminal:

cargo run -p boundary -- run --config boundary.yaml

Scan the safe sample config:

cargo run -p boundary -- scan --config .mcp/servers.json --policy boundary.yaml

Scan the unsafe sample config:

cargo run -p boundary -- scan --config .mcp/unsafe-servers.json --policy boundary.yaml

Policy example

version: 1
servers:
  filesystem:
    allow:
      - tools: ["read_file", "list_directory"]
        paths: ["./", "./docs/**"]
    deny:
      - tools: ["write_file", "delete_file", "move_file"]
  shell:
    deny:
      - tools: ["*"]

Boundary denies by default. Deny rules take precedence over allow rules.

Streamable HTTP proxy

Boundary can also run a local Streamable HTTP MCP endpoint in front of a remote Streamable HTTP upstream:

cargo run -p boundary -- http-proxy \
  --server malicious \
  --config boundary.yaml \
  --audit-db .boundary/audit.sqlite \
  --listen 127.0.0.1:8787 \
  --endpoint /mcp \
  --upstream https://remote.example/mcp

Point an MCP client at the local endpoint:

{
  "mcpServers": {
    "malicious-http": {
      "url": "http://127.0.0.1:8787/mcp"
    }
  }
}

The HTTP proxy validates Origin, binds to localhost by default, forwards MCP session/protocol headers, and passes through upstream SSE streams while inspecting matching JSON-RPC responses.

GitHub Action

- uses: ./.github/actions/boundary-scan
  with:
    config: .mcp/servers.json
    policy: boundary.yaml

The action fails on direct shell servers, inline execution flags, missing Boundary wrappers, and broad filesystem access without an explicit read-only policy.

Development

cargo fmt
cargo test
cargo clippy --workspace --all-targets -- -D warnings
pnpm lint
pnpm test
pnpm build
pnpm test:e2e

License

MIT