AI Defense Stack

Agent & MCP security

mcp-context-protector: MCP security wrapper with server pinning

mcp-context-protector is an MCP security wrapper with server pinning from Trail of Bits. It is open source under the Apache-2.0 license and is offered as: CLI.

  • Last reviewed
Visit mcp-context-protector (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 7: Agent and tool access

Best for

  • Developers who run third-party MCP servers in a desktop MCP client and want changes to those servers blocked until they approve them
  • Security engineers who want a reviewable quarantine of tool responses that a prompt injection guardrail flagged, instead of silent blocking

Consider instead if

  • You want to scan MCP servers before use instead of wrapping the live connection. See MCP-Scan or Cisco MCP Scanner.
  • You want a proxy with plugins that mask secrets and personal data and log every tool call, rather than change pinning. See Lasso MCP Gateway.

What mcp-context-protector does

mcp-context-protector, from Trail of Bits, applies trust on first use to MCP. When you first connect a server you approve its instructions, tool descriptions and input schemas; if any of them later change, tool calls stop until you review the server again. That targets the rug pull, where a trusted server rewrites its tool text. mcp-scan also tracks tool description hashes, but as a scan you rerun, while this wrapper sits in the live connection and blocks calls itself. It also strips ANSI control characters, and when started with a guardrail provider such as LlamaFirewall it holds flagged tool responses in a quarantine file for review. It can wrap every server in the configs of Claude Code, Claude Desktop, Cursor, VS Code, Continue.dev and Windsurf, but not configs inside project folders. Apache-2.0, installed from source, with no tagged releases.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Trail of Bits Source, checked October 21, 2026: github.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
226 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
April 14, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
Not documented in the sources we checked
Deployment
CLI Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Documentation
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
Vulnerability reports go to Trail of Bits through the contacts in its security.txt Source, checked October 21, 2026: trailofbits.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where mcp-context-protector fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that mcp-context-protector covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L3 Supply chain Model and supply chain Also covers Documents pinning of the approved MCP server configuration. Pins an approved server configuration and blocks downstream tool calls when it changes until the user approves it again; Pinning compares server instructions, tool descriptions and tool input schemas semantically, ignoring tool and parameter order; Sanitizes ANSI control characters, with an option to show escape codes as visible ESC text
L6 Runtime Runtime guardrails Also covers Documents quarantine of tool responses that a guardrail provider flags for prompt injection. With a guardrail provider such as LlamaFirewall, scans tool responses for prompt injection and quarantines flagged ones

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to mcp-context-protector, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Scans tool responses for prompt injection and blocks calls to a server whose setup changed. Pins an approved server configuration and blocks downstream tool calls when it changes until the user approves it again; With a guardrail provider such as LlamaFirewall, scans tool responses for prompt injection and quarantines flagged ones; Pinning compares server instructions, tool descriptions and tool input schemas semantically, ignoring tool and parameter order; Sanitizes ANSI control characters, with an option to show escape codes as visible ESC text

Not mapped in our analysis: LLM02, LLM05, LLM06, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

mcp-context-protector FAQ

Is mcp-context-protector open source?

Yes. It is released under the Apache-2.0 license in the trailofbits/mcp-context-protector repository on GitHub.

Is it a scanner?

No. The README describes it as a wrapper that sits in the connection between an MCP client and a server, not a pre-install scanner.

What happens when a server changes?

Approved server configurations are stored locally. If a server deviates from its approved configuration, downstream tool calls are blocked until the user approves it with --review-server.

What does it compare when it checks a server?

The server instructions, tool descriptions and tool input schemas, compared semantically so a change in tool or parameter order does not count. A server is identified by its URL or launch command, so editing that command makes it a new server that needs approval.

Key facts you can cite

We have no commercial relationship with Trail of Bits.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.