概要

MCP-Context-Protectorは、信頼できないMCPサーバーの実行に伴うリスク、例えばラインジャンプ、予期しないサーバー設定変更、その他のプロンプトインジェクション攻撃に対応するセキュリティラッパーです。これらのセキュリティ制御をラッパーを通じて実装することで(ツールインストール前にスキャナーを起動したり、MCPホストアプリにセキュリティ機能を追加したりするのではなく)、執行が効率化され、すべてのMCPアプリとの普遍的な互換性が保証されます。

特徴

• サーバー構成の初回使用時の信頼ピン
• 未承認の設定変更の自動ブロック
• ガードレールスキャンおよびツール応答の隔離
• ANSI制御文字サニタイズ
• mcp.jsonファイルの編集支援

クイックスタート

設置:

mcp-context-protectorの起動を簡単にするために、mcp-context-protector.shを更新してuvへの全パスを含めることをお勧めします。Claude Desktopを含む一部のMCPクライアントは、MCPサーバー起動時にPATH環境変数を最小限のパスに置き換えるため、claude_desktop_config.jsonファイルが扱いにくくなり、管理が難しくなることがあります。

mcp-context-protector

Overview

mcp-context-protector is a security wrapper for MCP servers that addresses risks associated with running untrusted MCP servers, including line jumping, unexpected server configuration changes, and other prompt injection attacks. Implementing these security controls through a wrapper (rather than through a scanner that runs before a tool is installed or by adding security features to an MCP host app) streamlines enforcement and ensures universal compatibility with all MCP apps.

Features

• Trust-on-first-use pinning of server configurations
• Automatic blocking of unapproved configuration changes
• Guardrail scanning and quarantining of tool responses
• ANSI control character sanitization
• Assisted editing of mcp.json files

Quickstart

Installation:

# Install uv
curl -LsSf https://astral.sh/uv/install.sh | sh
# Download mcp-context-protector
git clone https://github.com/trailofbits/mcp-context-protector
# Install dependencies
cd mcp-context-protector
uv sync

To make it easier to launch mcp-context-protector, we recommend updating mcp-context-protector.sh to contain the full path to uv. Some MCP clients, including Claude Desktop, replace the PATH environment variable with a minimal set of paths when launching MCP servers, which can make your claude_desktop_config.json file unwieldy and hard to maintain. Including a full path to uv in the launcher helps mitigate this problem.

Now configure your client to run your MCP servers through mcp-context-protector, and tool configuration pinning will automatically be enabled. Here’s a sample Claude Desktop config:

{
  "mcpServers": {
    "wrapped_acme_server": {
      "command": "/path/to/mcp-context-protector/mcp-context-protector.sh",
      "args": ["--command", "/path/to/node /path/to/acme/server.js"]
    }
  }
}

Alternatively, use --command-args to have mcp-context-protector concatenate all arguments that follow into one command string:

{
  "mcpServers": {
    "wrapped_acme_server": {
      "command": "/path/to/mcp-context-protector/mcp-context-protector.sh",
      "args": ["--command-args", "/path/to/node", "/path/to/acme/server.js", "--acme-enhanced"]
    }
  }
}

TL;DR: use --command-args if your MCP client mangles your stdio server command, but be careful with escaping of shell metacharacters.

Longer explanation: Some clients (including, as of this writing, Cursor) will construct their MCP server commands by concatenating the arguments together into a space-delimited string. That is, mcp-context-protector.sh --command "cmd arg1 arg2 --arg3" will become mcp-context-protector.sh --command cmd arg1 arg2 --arg3, and mcp-context-protector will think arg1 through --arg3 are meant as arguments to the wrapper, not to the child command. The --command-args option addresses this issue.

Security risks and controls