Zero-trust security gateway between AI agents and MCP servers: scoped capabilities, redaction, rate and cost limits, and verifiable session logs.
03:14 — a session you didn't fully trust just asked a tool server to run shell.exec { "cmd": "rm -rf /" }. The client thought it was fine. The server would have obeyed. Between them sat one process reading the line off stdin, matching shell. against a deny rule, writing nothing to stdout, and dropping a single JSON audit event that says exactly why. That process is MCP Bastion.
MCP Bastion is a local zero-trust checkpoint for the Model Context Protocol. It reads newline-delimited JSON-RPC from stdin, decides each message against a policy — allow / deny / redact — and writes only what survives to stdout. Every message, forwarded or not, leaves a one-line audit record. It runs entirely on your machine, uses no third-party runtime dependencies, and fails closed: anything it cannot confidently authorise is denied or dropped, never forwarded.
Read this before anything else — the honesty here is the whole point.
- It is a line-oriented relay that sits on the MCP stdio transport, inspects a handful of JSON-RPC fields, and enforces a policy on tools/call. - It is not a transport proxy. It does not speak HTTP or SSE, does not open sockets, does not manage the MCP handshake, and does not spawn the downstream server for you. It moves bytes between one stdin and one stdout, framed as one JSON object per \n-terminated line. That is the entire I/O contract. - It is not a JSON validator. There is no full parser inside. There is a small, single-pass field extractor (gateway/src/jsonscan.rs) that reads exactly four fields — method, id, params.name, params.arguments — while correctly skip
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/Matthew0822--MCPBastion.html)
Security & governance guardrails for MCP agents in Java — audit trail, agent-to-tool authorization, prompt-injection detection and rate limiting as a zero-config Spring Boot starter.
omaekumiko2-create/kruLocal-first MCP password and credential manager for AI agents. Use passwords, API keys, SSH identities, and TOTP without exposing hidden plaintext to the model.
naw103/foremergeCatch intent conflicts before code conflicts. The open-source coordination protocol for coding agents, built above Git.
naman-sharma12345/kimoMCP-first AI video editor in Rust/C++. Every operation is an AI-callable tool.
menot-you/n-memoryMemory your agent can trust — every answer carries its source; when it doesn't know, it says so. Hermetic, local, MCP.
Kaseban/batonConvert AI coding sessions between Claude Code, Codex, OpenCode, Zed, Aider, Gemini CLI, Cursor, Cline & more — lossless, round-trip tested. MCP server + CLI.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.