/mcp

MCP security that maps to OWASP MCP Top 10.

A Clampd-guarded proxy in front of any downstream MCP server. Every tools/list and tools/call routed through the gateway: descriptor hashing for rug-pull detection, scope tokens, prompt injection detection on tool params, response-side PII scanning, full audit trail. Plug into Claude Desktop or any MCP client today.

pip install clampd python -m clampd.mcp_server --downstream "..."
Modes: stdio proxy · TS proxy Maps to: OWASP MCP Top 10, MCP02, MCP03, MCP05, MCP06, MCP10 Verified incidents: CVE-2026-33032 · LettaAI / Windsurf · Invariant Labs GitHub MCP

The problem

MCP servers are spreading like npm packages: hundreds shipped, wired into agents as casually as a dependency, with the same supply-chain blind spots. The default MCP trust model has known gaps catalogued by the OWASP MCP Top 10:

Public incidents have followed: CVE-2026-33032 (CVSS 9.8) in nginx-ui exposed an unauthenticated MCP message endpoint; a design flaw affected LettaAI, LangFlow, and Windsurf in April 2026; Invariant Labs disclosed prompt-injection against the official GitHub MCP server. Independent benchmarks report tool-poisoning success rates around 84% with auto-approval enabled.

How the proxy works

LLM client (Claude Desktop, custom MCP client, etc.)
       │
       │  MCP JSON-RPC (tools/list, tools/call)
       ↓
Clampd MCP proxy
       │
       │  1. Discovers tools from downstream via tools/list
       │  2. Computes contract_hash(name, description, parameters) per tool
       │  3. Caches descriptor hashes for the session
       │  4. Forwards tools/list to client (annotated)
       │
       ↓  On tools/call:
       │
       │  POST /v1/proxy → 9-stage Clampd gateway:
       │     - Auth, rate limiting
       │     - Tool descriptor hash match (rug pull check)
       │     - Intent classification (287 rules)
       │     - Policy decision
       │     - Scope token mint (if allowed)
       │     - Audit emit
       │
       ↓  If allowed:
       │
Downstream MCP server (filesystem, github, postgres, custom)

Integration flow

01 MCP client tools/list, tools/call Cursor, Claude Desktop 02 Clampd MCP proxy transparent shim stdio passthrough 03 Descriptor hash SHA-256 stable check rug-pull detection 04 Clampd Gateway rules, policy, scope 287 rules evaluated JSON-RPC name + params if hash matches allow deny Real MCP server downstream tool runs Response inspector PII, secrets, prompt-inj tool result Client gets response scrubbed, signed, audited scrubbed Structured error deny code + reason error returned to client

The proxy sits in front of the MCP server unchanged. Tool-poisoning and rug-pulls get caught before the client ever sees the result.

Install + run

# Python, proxy any stdio MCP server
pip install clampd

python -m clampd.mcp_server \
  --downstream "npx -y @modelcontextprotocol/server-filesystem /tmp" \
  --agent-id "<your-agent-uuid>" \
  --gateway https://gateway.clampd.dev

# TypeScript, same idea, npm package
npm install @clampd/sdk
npx clampd-mcp --downstream "npx -y @modelcontextprotocol/server-github" \
  --agent-id "<your-agent-uuid>"

For Claude Desktop, edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent on your platform:

{
  "mcpServers": {
    "filesystem-guarded": {
      "command": "python",
      "args": [
        "-m", "clampd.mcp_server",
        "--downstream", "npx -y @modelcontextprotocol/server-filesystem /tmp",
        "--agent-id", "<your-agent-uuid>",
        "--gateway", "https://gateway.clampd.dev"
      ]
    }
  }
}

Restart Claude Desktop. Tools that used to call the filesystem server directly now flow through Clampd. Path traversal, sensitive-file reads (.env, .ssh/), and PII patterns in tool responses are all caught before the LLM sees them.

What the proxy adds

Tool descriptor hashing

SHA-256 over (name, description, parameters) per tool, computed at session start. If a downstream server changes a schema between deploys, the hash mismatches and the gateway returns a typed descriptor_hash_mismatch: denial. Direct defence against MCP rug pulls (MCP03).

Prompt injection on tool responses

Tool responses scanned before they enter the LLM context. Catches indirect prompt injection (MCP06) where a malicious server returns content designed to subvert the calling agent's instructions.

Scope-token enforcement

Each approved tool call gets a short-lived Ed25519-signed token bound to (tool, params). Tools that verify the token via JWKS gain anti-replay against captured tokens used with different params.

Session correlation

16 cross-call patterns watch for slow-drip exfiltration, schema-recon-then-attack, sawtooth risk evasion, cross-tool bridging. Per-call inspection alone misses these by design.

Full audit trail

Every tools/call goes to ClickHouse with full descriptor, params, response metadata, matched rules, decision reasoning. Closes MCP08 (lack of audit/telemetry) at the proxy layer.

Auto tool registration

Discovered tools appear in your dashboard for category assignment. Unmapped tools get empty scopes (denied by default), so a malicious MCP server can't introduce new tools that auto-bypass policy.

Honest limits

The descriptor-hash check protects against between-session schema mutation (the dominant rug-pull attack). It doesn't, on its own, catch within-session mutation in long-lived MCP sessions; that requires re-discovering tools mid-stream, which we're working on. The proxy is also not a sandbox, once the gateway approves, the downstream server runs with whatever process privileges it has. Combine with OS-level least-privilege for full defence.

Deep-dive reading

Plug Clampd in front of any MCP server

Works with Claude Desktop, custom MCP clients, and any stdio-based MCP server. Self-hosted gateway free for under 25 agents.

Get a gateway → All products