Lessons learned building Fronteira, an MCP proxy with behavioral guardrails

Lessons Learned Building Fronteira, an MCP Proxy with Behavioral Guardrails

The author, an expert in AI, Software Engineering, and Programming Languages, developed a harness using dependent types and information-flow policies to prevent attacks involving the lethal trifecta. However, they realized that requiring users to write liquid types was unrealistic and creating a custom SDK for every external interface was impractical.

Fronteira, an MCP proxy designed to make technical ideas accessible to a wider audience, acts as a behavioral firewall. Users log in through a browser, add integrations with various services, and authenticate their harnesses with Fronteira. All MCP interactions go through Fronteira, allowing it to track behavior across multiple MCP servers and prevent attacks by centralizing data and logging tool calls.

Fronteira also allows users to write rules in natural language, which are then translated into the Guard DSL for deterministic evaluation. However, limitations exist, such as harnesses accessing the filesystem and internet directly, bypassing Fronteira. Implementing support for dynamic tool lists and handling schema changes also proved challenging. Trusting Codex with DevOps was found to be optimistic, as demonstrated by an incident where the AI changed the server root, exposing sensitive data.