Mcpwall
Put a policy firewall in front of your MCP tool graph so agents cannot run blocked calls or leak secrets unnoticed.
Overview
mcpwall is a MCP server for the Ship phase that blocks risky tool calls, scans for secrets, and logs MCP traffic like a firewall for agents.
What is this MCP server?
- Blocks dangerous MCP tool calls with iptables-style rules
- Scans outbound tool payloads and responses for secret patterns
- Logs every tool invocation for later review and incident triage
- Stdio npm package (mcpwall v0.1.2) for Claude Code, Cursor, and other MCP clients
- Sits inline between the host and downstream MCP servers without replacing them
- Server version 0.1.2 on npm identifier mcpwall
- Transport: stdio
- Repository: github.com/behrensd/mcp-firewall
Community signal: 3 GitHub stars.
What problem does it solve?
One compromised or over-permissive MCP tool can let an agent run destructive commands or leak API keys with no central policy layer.
Who is it for?
Indie builders running multiple MCP servers against real repos, cloud accounts, or customer data who need deny rules and logging before going live.
Skip if: Single-tool local experiments with no secrets and no need for centralized MCP policy or audit trails.
What do I get? / Deliverables
After registration, tool calls pass through enforced rules, secret scanning, and audit logs so you can ship MCP stacks with clearer guardrails.
- Policy-gated MCP tool execution path
- Secret-scanning pass over MCP traffic
- Persistent logs of tool calls for security review
Recommended MCP Servers
Journey fit
How it compares
Inline MCP security gateway, not a replacement skill for code review or static appsec scanning.
Common Questions / FAQ
Who is Mcpwall for?
Solo and small-team builders who connect several MCP servers to Claude Code, Cursor, or Codex and want firewall-style control over which tool calls are allowed.
When should I use Mcpwall?
Use it during Ship and Operate when you are hardening agent workflows, blocking dangerous tools, scanning for secrets, and keeping logs of what MCP executed.
How do I add Mcpwall to my agent?
Install the npm package Mcpwall (v0.1.2), register it as a stdio MCP server in your client config, and place it upstream of the MCP servers you want to protect per the mcp-firewall repo instructions.