Proxilion MCP Security Gateway

Real-time threat detection for AI coding assistants. Analyzes MCP tool calls to detect insider threats, compromised accounts, and rogue AI agents before they can weaponize Claude Code, GitHub Copilot, Cursor, or Windsurf.

---

What This Is

Proxilion is a Rust-based security gateway that sits between AI assistants and MCP servers. It analyzes every tool call (bash commands, file operations, network requests) for malicious patterns before execution.

What it does well:

• Pattern-based threat detection (credential harvesting, network reconnaissance, data exfiltration)
• Session correlation (tracks multi-phase attack chains)
• Low latency analysis (<50ms P95 in benchmarks)
• Custom policy DSL for rules, allowlists, blocklists
• 358 tests passing

What it does NOT do:

• Prevent attacks that don’t involve MCP tool calls
• Detect novel attack patterns not in its ruleset
• Provide authentication (you must deploy behind an auth layer)
• Guarantee detection of sophisticated attackers

---

Quick Start

Docker Deployment

git clone https://github.com/clay-good/proxilion
cd proxilion

# Start in monitor mode (logs only, never blocks)
docker compose up -d

# Check health
curl http://localhost:8787/health

# View metrics
curl http://localhost:8787/metrics

Build from Source

cargo build --release

# Run with in-memory session store (testing only)
SESSION_STORE=inmemory MODE=monitor ./target/release/proxilion-gateway

# Run with Redis (production)
SESSION_STORE=redis REDIS_URL=redis://localhost:6379 MODE=block ./target/release/proxilion-gateway

Enable Monitoring Stack

docker compose --profile monitoring up -d

• Grafana: http://localhost:3001 (admin/admin)
• Prometheus: http://localhost:9090

---

Architecture

AI Assistant (Claude Code, Copilot, etc.)
        |
        v
Proxilion Gateway (analyzes tool call, <50ms)
        |
        v
Decision: Allow | Alert | Block | Terminate
        |
        v
MCP Server executes (or rejects) the tool call

Components

Threat Analyzers (24 Active in Pipeline)

Pattern-Based (22):

• Enumeration (nmap, masscan, port scanning)
• Credential Access (.env, SSH keys, AWS credentials, /etc/shadow)
• Exfiltration (curl to external IPs, pastebin uploads, netcat)
• AI Velocity (automated execution patterns)
• Prompt Engineering (jailbreak attempts)
• Social Engineering (authority claims, roleplay manipulation)
• Callback Validation (C2 detection, SSRF)
• MCP Orchestration (malicious MCP chaining)
• File Access (sensitive file patterns)
• Task Fragmentation (command chaining, obfuscation)