Why Model Context Protocol (MCP) Needs an Execution Firewall (And How We're Experimenting with One in Rust)

The Model Context Protocol (MCP) represents a significant advancement for developers integrating Large Language Models (LLMs) with external systems. However, once an LLM selects a tool to execute, the execution process is often direct, with the LLM making API calls using pre-configured credentials. This direct approach exposes systems to risks if the LLM hallucinates, misinterprets data, or falls victim to prompt injection attacks.

To address these concerns, a team is experimenting with a Rust-based zero-trust proxy called the Trust Gateway. This proxy operates as an inline firewall between the LLM and downstream tools, treating tool calls as untrusted proposals rather than automatic commands. The Trust Gateway enforces several core principles: it never stores long-lived credentials with the LLM, it verifies action proposals using cryptographic signatures and signed policies, and it implements fail-closed mechanisms that pause and require human approval for high-risk actions.

During testing, an agent was tasked with fetching data and triggering a billing API action. The Trust Gateway verified the action proposal, creating a short-lived, single-use grant bound to the exact input arguments. If the agent attempted to reuse or alter the grant, the signature verification would fail, preventing unauthorized actions.

This experimental setup demonstrates a promising approach to enhancing the security and reliability of LLM tool execution while maintaining the flexibility and standardization benefits of the Model Context Protocol.