v0.1.0 — Initial release

First public release of MCPGate.

What it does

Transparent proxy for Model Context Protocol (MCP) stdio traffic. Sits between any MCP client (Claude Code, Cursor, custom agents) and any MCP server. Logs every tool call to a local SQLite database and enforces three hard-coded attack blocks:

• Cross-repository access — contains blast radius when an agent is tricked into touching a repo it shouldn't
• Prompt-injection phrases in tool responses — blocks poisoned content from Jira tickets, GitHub issues, or retrieved files before it reaches the model
• Destructive shell and database commands — catches rm -rf, DROP TABLE, git push --force, TRUNCATE, fork bombs, and similar patterns

Installation

Requires Python 3.11+ on Linux or macOS.

git clone https://github.com/hishambjihad-ctrl/mcpgate.git
cd mcpgate
pip install -e .

See the README for Claude Code and Cursor configuration.

Scope

• Supported transport: stdio only
• HTTP/SSE transport: planned for v0.2
• Platform: Linux, macOS
• Configuration: none beyond MCPGATE_DB_PATH environment variable

Tests

37 tests passing across framing, rules, storage, and full proxy integration (happy path, cross-repo block, injection block, destructive-shell block, subprocess crash).

Known limitations

• Stdio transport only
• Rules are hard-coded (no policy DSL in v0.1)
• No alerting (blocks visible via mcpgate tail)
• No web UI — CLI only

Context

This release responds to a wave of public MCP security incidents between May 2025 and April 2026, and Anthropic's public decision not to patch these behaviors at the protocol level.