aegisgatesecurity/aegisgate-mcp

AegisGate Security™ is a trademark of AegisGate Security, LLC, filed with the USPTO. “AegisGate MCP” is an unregistered product name. See Trademark below.

---

Why AegisGate MCP?

38% of MCP servers have no authentication. 590+ security advisories. 3 critical CVEs in the official MCP SDKs in 6 months — including CVSS 9.8 remote code execution and the “Mother of All AI Supply Chains” flaw affecting 150M+ downloads.

The official MCP SDKs give you the protocol. They don’t give you security. No authentication. No audit logging. No threat detection. No rate limiting. No RBAC. Every server built on a bare SDK starts with a blank security posture and it’s on you to build it — or skip it, as 38% of servers do.

AegisGate MCP is the secure alternative. Build your MCP server on a foundation that has security built in from line one — not bolted on after a breach.

23 security layers. 79 regex patterns. Zero dependencies. Zero CVEs. Apache 2.0.

Need proxy mode, OAuth, SIEM, or compliance frameworks? See When to Upgrade to AegisGate Platform below — or explore AegisGate Rampart for local AI API proxy protection.

---

Overview

AegisGate MCP is a hardened, zero-dependency MCP server written in pure Go. It sits between AI agents and the tools they call, applying 23 layers of defense to every request — from authentication and RBAC to neural threat detection and chain analysis.

Standard MCP servers assume a trusted local environment. In production — whether that’s a cloud SaaS platform, an enterprise data pipeline, or an air-gapped plant network — agents may execute commands, query databases, or interact with critical systems. A single unauthorized or malicious tool call can cause data exfiltration, process disruption, or worse. AegisGate MCP wraps every tool call in defense-in-depth, all with zero external module dependencies so it can run air-gapped.

---

Quick Start

Build

go build -o mcp-server ./cmd/mcp-server

Run

# Basic TCP server on :8081
./mcp-server

# With authentication and audit logging
./mcp-server --token my-secret --audit /var/log/mcp-audit.json

# With demo tools (ping, system_info, echo)
./mcp-server --demo

# stdio mode for local MCP clients (Claude Desktop, Cursor)
./mcp-server --transport stdio --demo

# Streamable HTTP mode (MCP 2025-06-18)
./mcp-server --transport http --addr :8081 --demo

# TLS + mutual TLS
./mcp-server --tls --tls-cert server.pem --tls-key server.key --tls-client-ca ca.pem

# Config file + health endpoint
./mcp-server --config /etc/mcp/config.json --health-addr :8082

Docker

# Build and run (ML-enabled, ~127 MB, 0 CVEs)
docker build --target ml -t aegisgate-mcp .
docker run -p 8081:8081 aegisgate-mcp --demo

# With authentication and audit logging
docker run -p 8081:8081 \
  -e MCP_AUTH_TOKEN=your-secret-token \
  -e MCP_DEMO_TOOLS=true \
  aegisgate-mcp

# Distroless heuristic-only build (~10 MB, 0 CVEs, zero OS packages)
docker build --build-arg CGO_ENABLED=0 --target lite -t aegisgate-mcp:lite .
docker run -p 8081:8081 aegisgate-mcp:lite --demo

The ML image uses debian:bookworm-slim with libgnutls30 purged (shared libraries and dpkg metadata removed), eliminating all 6 Trivy CVEs while keeping the glibc and ONNX Runtime dependencies required for neural inference. The lite image is true distroless (gcr.io/distroless/static-debian12:nonroot) — zero OS packages, zero CVEs, ~10 MB. Both targets include a built-in --health-check flag for Docker HEALTHCHECK (no wget/curl needed). Multi-arch builds support both linux/amd64 and linux/arm64.

ML Threat Detection (L3)

AegisGate MCP includes the same CharCNN-BiLSTM v13 neural model used by AegisGate Platform and Rampart — vendored with zero external module dependencies. The model provides:

• Semantic attack detection — catches prompt injection and jailbreak attempts that bypass regex pattern matching
• Evasion resistance — detects obfuscation techniques (leetspeak, Unicode homoglyphs, character transposition, vowel deletion, word reversal)
• Two-tier blocking — scores ≥0.95 block independently; scores 0.50–0.94 block only if L1 (regex) or L2 (input scanner) corroboration is present
• Shadow mode — log predictions without blocking (for calibration)
• Heuristic fallback — when CGO is unavailable, heuristic scoring provides baseline detection without ONNX

Library Usage

AegisGate MCP can be embedded as a Go library:

package main

import (
    "context"
    "log"
    mcp "github.com/aegisgatesecurity/aegisgate-mcp"
)

func main() {
    cfg := mcp.DefaultServerConfig()
    cfg.AuthToken = "my-secret-token"
    cfg.AuditLogPath = "/var/log/mcp-audit.json"
    cfg.RateLimitRPM = 120
    cfg.ScanResponses = true

    server, err := mcp.NewSecuredMCPServer(cfg)
    if err != nil {
        log.Fatal(err)
    }

    // Register a custom tool
    // Note: tools are automatically scanned for prompt-injection poisoning
    // at registration time. If the description or inputSchema contains
    // malicious patterns, RegisterTool returns *ToolPoisoningError.
    server.RegisterTool("my_tool", "Does something useful", 40, map[string]interface{}{
        "type": "object",
        "properties": map[string]interface{}{
            "param1": map[string]interface{}{"type": "string"},
        },
        "required": []interface{}{"param1"},
    })
    server.RegisterToolHandler("my_tool", func(ctx context.Context, params map[string]interface{}) (interface{}, error) {
        return "result", nil
    })

    // Register a resource (MCP resources/list, resources/read)
    server.RegisterResource("config://app/info", "App Info", "App config as JSON", "application/json",
        func(ctx context.Context, uri string) (*mcp.ResourceContent, error) {
            return &mcp.ResourceContent{URI: uri, Text: `{"version":"1.0"}`, MimeType: "application/json"}, nil
        })

    // Register a prompt (MCP prompts/list, prompts/get)
    server.RegisterPrompt("code_review", "Generate a code review prompt",
        []mcp.PromptArgument{{Name: "filename", Required: true}},
        func(ctx context.Context, args map[string]string) (*mcp.GetPromptResult, error) {
            return &mcp.GetPromptResult{
                Messages: []mcp.PromptMessage{{Role: "user", Content: "Review " + args["filename"]}},
            }, nil
        })

    // Load built-in policy rules
    server.LoadDefaultPolicies()

    // Start the server
    if err := server.Start(context.Background()); err != nil {
        log.Fatal(err)
    }
    defer server.Stop()
}

See examples/simple-server/ for a complete working example that registers a tool, resource, and prompt.

ML Model Hot-Swap

Reload the neural threat detection model at runtime without restarting the server:

// Swap to a new ONNX model file (verifies SHA-256 hash)
err := server.ReloadMLModel("/path/to/new_model.onnx")
if err != nil {
    log.Printf("model reload failed: %v", err)
}

Tool Poisoning Detection

All tools registered via RegisterTool() are automatically scanned for prompt injection in their descriptions and inputSchema. To scan manually:

err := server.ScanToolForPoisoning("my_tool", description, inputSchema)
if err != nil {
    // err is *ToolPoisoningError — do not register this tool
}

---

Security Layers

AegisGate MCP applies 23 security layers to every request, in order:

Detection Pattern Categories (79 patterns)

AegisGate MCP scans all tool parameters and responses with 79 regex patterns across 8 categories:

---

---

---

---

---

---

---

---

Demo Tools

Enable demo tools with the --demo flag or by calling RegisterDemoTools() in library mode. These are safe, read-only tools that do not access the filesystem, network, or any external resources.

Example — system_info response:

{
  "go_version": "go1.26.9",
  "os": "linux",
  "arch": "amd64",
  "cpus": 8,
  "goroutines": 12,
  "timestamp": "2026-10-08T08:58:00Z"
}

---

Documentation

Detailed documentation is available in the docs/ directory:

Changelog

See CHANGELOG.md for version history and notable changes.

---

Platform Interop (Optional)

AegisGate MCP can optionally integrate with AegisGate Platform for pattern pulling and event forwarding:

• Pattern Pull: Fetch canonical detection patterns from Platform’s telemetry endpoint with ETag caching
• Event Forwarding: Send security events to Platform’s telemetry receiver in canonical contract format
• Tool Description Screening: Enhanced with 34 dangerous function patterns from AegisGate Scanner

All interop features are air-gap compatible — fully disabled when platform_url is not configured. No network calls, no telemetry, no external dependencies.

---

When to Upgrade to AegisGate Platform

AegisGate MCP is a standalone secure MCP server framework — perfect for building and running MCP servers with security built in. It’s free, open source, and has zero external dependencies.

When your needs grow beyond a single server, AegisGate Platform is the natural upgrade path:

Think of it this way: AegisGate MCP is the secure foundation you build MCP servers on. AegisGate Platform is the enterprise gateway that secures all AI traffic across your organization — including MCP, HTTP, A2A, and ACP.

Other AegisGate products:

• AegisGate Rampart — Free local proxy for developers using Claude, Cursor, or Copilot
• AegisGate Lens — Free browser extension for everyday AI conversations

---

License

Apache-2.0. See LICENSE for the full text and NOTICE for attribution.

Security

See SECURITY.md for vulnerability reporting.

Contributing

See CONTRIBUTING.md. All commits must be signed off (git commit -s) per the DCO.

---