DEV Community

relayshieldadmin
relayshieldadmin

Posted on

Introducing the MCP Proxy Firewall: Stop Poisoned Neighbors Before They Poison You

#mcp #ai #security #agents

Introducing the MCP Proxy Firewall: Stop Poisoned Neighbors Before They Poison You

The Model Context Protocol (MCP) has become the standard for connecting AI agents to tools and data sources. But as adoption grows, so does the attack surface.

We built the MCP Proxy Firewall to secure the MCP ecosystem.

The Problem: Poisoned Neighbors

MCP servers are the new attack surface. When your agent connects to a third-party MCP server, you're trusting that server with your agent's capabilities. A single compromised server can:

  • Inject hidden instructions into tool responses (prompt injection)
  • Exfiltrate credentials to attacker-controlled domains
  • Serve phishing kit fingerprints disguised as legitimate widgets
  • Leak unredacted PII (SSNs, credit cards, bulk emails)
  • Abuse OAuth flows to steal tokens via malicious redirect URIs
  • Perform SSRF attacks to access internal infrastructure

The CVEs prove this isn't theoretical:

  • argocd-mcp shipped with no authentication, allowing unauthenticated access to deployments (CVE-2026-82456 pattern)
  • Rill had an OAuth flow that let attackers skip consent entirely
  • Multiple MCP servers have been found with prompt injection in tool descriptions

The OpenClaw incident brought this home. In the ClawHavoc attack, over 800 malicious skills were uploaded to OpenClaw's marketplace, triggering 1,142 security advisories. With 135,000+ exposed instances, the blast radius was enormous. OpenClaw uses MCP via the mcporter bridge, which means every one of those poisoned skills was a potential MCP attack vector. This wasn't a hypothetical. It was a marketplace-scale compromise of the exact ecosystem we're securing.

The Solution: Two Layers of Defense

Layer 1: Pre-Deployment Scanner (Free)

Before you connect your agent to an MCP server, scan it. Our pre-deployment scanner checks tool definitions for:

  • Prompt injection phrases: "ignore previous instructions", "you must now", "act as", system prompt overrides
  • Instruction hijacking: Tool descriptions that tell agents to behave differently
  • Exfiltration instructions: Descriptions telling agents to send data to external URLs
  • Dangerous capabilities: Shell execution, file deletion, arbitrary code execution
  • Credential harvesting: Input schemas requesting passwords, API keys, tokens
  • Unauthenticated access: Servers with no auth (the argocd-mcp pattern)

The scanner is free. Use it before every new MCP connection.

Layer 2: Runtime Proxy Firewall

Deploy as a reverse proxy between your agent and MCP servers. Every tool call and result is screened in real time:

SSRF Protection:

  • Blocks internal URLs (localhost, 169.254.169.254, 10.x, 192.168.x)
  • Validates redirect chains (max 3 hops, no protocol downgrade)
  • Stops DNS rebinding attacks
  • Deep document validation extracts and validates embedded URLs

OAuth Tampering Detection:

  • Flags suspicious scopes (long_lived_access_token, admin, *)
  • Blocks evil domains mimicking identity providers
  • Validates redirect URIs against allowlists

PII Protection:

  • Detects unredacted SSNs, credit cards, bulk emails in responses
  • Flags for review instead of blocking (fail-open with alert)

Threat Intelligence:

  • Matches responses against known phishing kit fingerprints
  • Screens URLs against 700K+ threat indicators
  • Checks wallet addresses for scam associations

Auditability:

  • Every decision is cryptographically signed
  • Full verdict history with cause codes
  • Confidence scores on every detection

Who This Is For

Enterprises: If your teams are building AI agents that connect to third-party MCP servers, you need runtime protection. The Proxy Firewall deploys as a transparent reverse proxy. No agent code changes required. Every decision is signed and auditable for compliance.

MSPs (Managed Service Providers): You manage MCP infrastructure for multiple clients. The Proxy Firewall gives you a single screening chokepoint. Deploy once, protect all your clients. The pre-deployment scanner lets you vet new MCP servers before onboarding them. White-label options available. If you're an MSP securing agentic workflows for clients, we want to talk.

Developers: The pre-deployment scanner is free. Integrate it into your CI/CD pipeline. Scan every MCP server before your agent connects.

Pricing

  • Cloud: $49/month flat, unlimited scans

The pre-deployment scanner is free forever. Scan before you connect.

Get Started

Why We Built This

We run RelayShield's threat intelligence operation, monitoring 125 Telegram marketplaces with 700K+ indicators. We see the phishing kits, the stolen credentials, the scam infrastructure.

When MCP emerged, we saw the same patterns forming. The protocol is powerful, but the security model assumes trusted servers. That assumption is already breaking.

The MCP Proxy Firewall is our answer: defense in depth for the agentic era.

RelayShield provides threat intelligence for the agentic economy. Our free MCP server offers scam checks for URLs, wallets, emails, and breach exposure with no signup required.

Top comments (0)