Zero-Trust MCP Firewall: Runtime Policy Enforcement & Adversarial Protection

The Need for a Runtime MCP Firewall

Traditional MCP clients connect directly to remote HTTP or stdio servers without runtime inspection. If an upstream server is compromised or drifts, the agent immediately executes unauthorized tools or ingests poisoned prompts.

ActionGuard's Zero-Trust Proxy Gateway acts as an inline firewall (similar to Cloudflare for websites), inspecting every tools/call invocation at the edge before forwarding to upstream servers.

Key Security Protections

• Adversarial Prompt Injection Blocker: Scans string arguments for system prompt extraction payloads, instruction override directives, and invisible markdown exfiltration links.
• Cryptographic Pinning Gate: Rejects tool calls if the remote server's schema has drifted from your pinned schema_sha256 hash.
• SSRF & Private Network Protection: Blocks calls attempting to pivot into local loopbacks (127.0.0.1, 169.254.169.254) or VPC subnets.

Configuring Claude Desktop or Cursor

Replace your direct server URL with the ActionGuard proxy URL:

{
  "mcpServers": {
    "sequential-thinking": {
      "url": "https://actionguard.ai/proxy/sequentialthinking-mcp",
      "headers": {
        "x-actionguard-pin": "a332729b0c307c465918a755016755db9389cce8aa53b75c706cf690bf7d4988"
      }
    }
  }
}