The MCP security tools all scan. None of them stop the call.
I spent a morning looking at MCP security tooling. Cisco has a scanner, there are three or four audit CLIs, all of them read your tool descriptions and report sketchy ones. Useful, but they share a blind spot: nothing sits between the agent and the server when the call actually happens. The failure mode that keeps showing up (the 159-point HN thread on MCP vulnerabilities is mostly this) is…
In a recent exploration of MCP security tools, the author discovered that none of them effectively prevent malicious calls from reaching the server. Cisco offers a scanner and multiple audit CLIs, which can identify suspicious tool descriptions, but they lack a crucial component: a barrier between the agent and server during the actual call.
A recurring failure mode, highlighted in a 159-point Hacker News thread on MCP vulnerabilities, involves agents executing commands like read_file with "../../etc/passwd" or fetching data from internal IP addresses like "http://169.254.169.254". To address this issue, the author developed mcp-bouncer, a tool that wraps any standard input/output (stdio) MCP server as a JSON-RPC proxy. mcp-bouncer filters tool responses, preventing unapproved tools from being accessed and normalizing path arguments to block traversal and encoding attempts.
The tool also enforces URL restrictions, rate limits, call timeouts, and appends decision logs to a JSONL file, while using digests of arguments instead of the arguments themselves to avoid exposing sensitive data. However, the initial version of mcp-bouncer blocked all calls due to a null byte check error, which was later resolved.
While mcp-bouncer provides protocol-level enforcement, it does not offer a sandbox for hostile binaries and only supports stdio transport. The author emphasizes that the tool is a starting point rather than a foolproof solution and is available on GitHub under the MIT license.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
