AI代理安全防火墙

rules:
  - name: "block_path_traversal"
    match: {arg_pattern: '\.\./'}
    action: BLOCK

  - name: "require_approval_shell"
    match: {tool_class: "shell_exec"}
    action: REQUIRE_APPROVAL

  - name: "allow_workspace_reads"
    match: {tool: "read_file", arg_pattern: "^/workspace/"}
    action: ALLOW

AI Agent (Claude / GPT / Cursor)
          | MCP JSON-RPC
          v
  +-------------------------------+
  |      MCP-Fortress Proxy       |
  |                               |
  |  [1] Policy Firewall          |  <- YAML rules, hot-reload
  |  [2] PII Scanner (inputs)     |  <- 22+ secret patterns
  |  [3] BAD Engine               |  <- sequence anomaly detection
  |  [4] Blast Radius Estimator   |  <- 0-100 pre-exec scoring
  |  [5] Cross-Session Correlator |  <- coordinated attack detection
  |  [6] PII Scanner (outputs)    |  <- redact before returning
  |                               |
  |  Dashboard  /dashboard        |  <- real-time web UI
  |  Approval   /api/v1/approve   |  <- human-in-the-loop
  +-------------------------------+
          | (if ALLOW)
          v
    Upstream MCP Server

pip install mcp-fortress

mcp-fortress proxy \
  --upstream "http://localhost:3000" \
  --policy examples/policy_enterprise.yaml \
  --port 8100

{
  "mcpServers": {
    "filesystem-protected": {
      "command": "mcp-fortress-stdio",
      "args": [
        "--policy", "/path/to/policy_developer.yaml",
        "--",
        "npx", "-y", "@modelcontextprotocol/server-filesystem", "."
      ]
    }
  }
}

mcp-fortress scan --target http://localhost:3000 --report report.html

# Core (zero external dependencies)
pip install mcp-fortress

# With HTTP proxy and dashboard
pip install mcp-fortress[proxy,yaml]

# Full install
pip install mcp-fortress[all]

docker run -p 8100:8100 \
  -v $(pwd)/examples/policy_enterprise.yaml:/app/config/policy.yaml \
  -e UPSTREAM_MCP_URL=http://your-mcp-server:3000 \
  ghcr.io/Avoceous/mcp-fortress:latest

mcp-fortress/
├── mcpshield/
│   ├── core/
│   │   ├── models.py          <- Data types: ToolCall, SecurityDecision, Alert
│   │   └── pipeline.py        <- Unified 6-stage security pipeline
│   ├── detectors/
│   │   ├── tdiv.py            <- Tool Description Integrity Verifier
│   │   ├── bad_engine.py      <- Behavioral Anomaly Detector
│   │   ├── blast_radius.py    <- Blast Radius Estimator
│   │   ├── pii_scanner.py     <- PII and Secret Scanner
│   │   └── correlator.py      <- Cross-Session Correlator
│   ├── policy/
│   │   └── firewall.py        <- Policy-as-Code Firewall
│   ├── transport/
│   │   ├── proxy.py           <- HTTP/SSE Proxy (FastAPI)
│   │   ├── stdio_proxy.py     <- stdio Proxy (Claude Desktop / Cursor)
│   │   └── dashboard.html     <- Real-time security dashboard
│   └── cli/
│       ├── main.py            <- CLI: proxy, scan, verify, report
│       └── scanner.py         <- Active vulnerability scanner
├── tests/
│   └── test_all.py            <- 40 tests across all modules
├── examples/
│   ├── policy_enterprise.yaml <- 15-rule enterprise policy
│   └── policy_developer.yaml  <- Lightweight developer policy
├── docs/
│   └── developer_guide.md     <- Full API reference and Kubernetes guide
├── scripts/
│   └── setup_github.sh        <- One-command GitHub publish
├── Dockerfile
├── docker-compose.yml
└── pyproject.toml

# mcp-fortress.yaml
mcpshield:
  proxy:
    host: "0.0.0.0"
    port: 8100
    upstream: "http://localhost:3000"

  integrity:
    enabled: true
    signing_key_env: "MCP_FORTRESS_SIGNING_KEY"

  behavioral:
    enabled: true
    max_calls_per_minute: 60

  blast_radius:
    enabled: true
    auto_allow_threshold: 20
    approval_threshold: 60
    block_threshold: 90

  pii_scanner:
    enabled: true
    action: "redact"

  audit:
    enabled: true
    log_file: "mcp_fortress_audit.jsonl"