mcpgawk

Product Introduction

1. Definition: mcpgawk is a local security and governance gateway for the Model Context Protocol (MCP). It functions as a middleware layer that intercepts, audits, and enforces policy on all communication between AI agents (like Claude Code, Cursor) and their MCP servers.
2. Core Value Proposition: It exists to solve the critical security blind spot of MCP tool drift. mcpgawk provides continuous MCP server monitoring, behavioral verification, and runtime enforcement to prevent unauthorized tool changes from being executed, enabling secure, unattended AI agent operation without compromising on safety or auditability.

Main Features

1. Fleet Scanning & Baseline Creation: The tool performs a comprehensive, local scan of all AI agent configurations on a machine, enumerating every connected MCP server. It establishes a cryptographic baseline of each server's approved tool surface (names, descriptions, schemas). This baseline acts as the source of truth for future enforcement. The scan also identifies security findings like undeclared credential inheritance and network egress.
2. Sandboxed Behavioral Verification (verify): Beyond static analysis, mcpgawk can launch MCP servers in an isolated sandbox to observe their actual runtime behavior. This MCP security analysis records what files are read, what network endpoints are contacted, and what system resources are accessed. Verdicts on server safety are based on observed evidence, not just declared metadata, providing a robust defense against tool poisoning and supply chain attacks.
3. Runtime Call Guarding & Enforcement: This is the core enforcement engine. It installs as a hook or runs as a standalone gateway, sitting in the execution path of every MCP tool call. Each call is checked in real-time against the approved baseline. Calls to new or modified tools are blocked pre-execution, and the agent receives a definitive security refusal. All decisions are logged in a tamper-evident, hash-chained audit trail. Approval for changes requires explicit, out-of-band human intervention.

Problems Solved

1. Pain Point: Uncontrolled MCP tool drift and silent updates. MCP servers can and do change their available tools between releases. A benign update or a malicious compromise can introduce new capabilities that agents can use without user re-approval, leading to potential data exfiltration, unauthorized writes, or credential misuse.
2. Target Audience: Development and platform engineering teams deploying AI agents; security engineers responsible for AI governance; individual developers using AI coding assistants with MCP in sensitive environments; enterprises rolling out agentic workflows who need compliance and audit logs.
3. Use Cases: Enforcing security policy for AI agents accessing production systems; safely allowing AI agents to run overnight or unattended; preparing for security audits by maintaining a complete record of MCP tool usage; onboarding new MCP servers safely with an evidence-based trust process; managing MCP server fleets across a team with consistent governance.

Unique Advantages

1. Strengths & Limitations (Pros & Cons):

   • Pros: Operates 100% locally with no data upload, ensuring privacy. Provides proactive, pre-execution blocking, not just post-hoc alerts. Creates an immutable audit log essential for compliance. Offers both a free CLI for individuals and a gateway for team-scale enforcement. Integrates behavioral sandboxing for deep inspection.
   • Cons: The free hook-based version only works with a subset of AI clients that support MCP hooks (e.g., Claude Code, Cursor). Protecting all agents requires the gateway tier. Adds a minimal latency overhead to MCP calls. Requires initial setup and baseline approval.

2. Key Alternatives & Differentiation:

   • Manual MCP Server Review: The standard alternative is manually reviewing server code/changelogs. mcpgawk automates this with continuous scanning and behavioral analysis, providing consistent, always-on protection that manual processes cannot match.
   • Network-Level Security Tools (e.g., Firewalls, Proxies): While these can block network access, they lack MCP semantics. mcpgawk understands the MCP protocol, can differentiate between allowed and disallowed tools on the same server, and can control local stdio servers, which network tools cannot see.
   • Other MCP Security Tools: Compared to emerging alternatives, mcpgawk's differentiation is its integrated workflow: scan -> verify -> baseline -> enforce -> decide -> audit. Its focus on tool-drift prevention via runtime enforcement and its principled stance on local-only operation for the core product are key distinctions.

Frequently Asked Questions (FAQ)

1. How does mcpgawk protect against malicious MCP server updates? mcpgawk creates a cryptographically-secure baseline of all tools when a server is first approved. If the server later updates and adds, removes, or changes a tool, any agent call to the new or modified tool is blocked before it executes. The server is never contacted, and the user is alerted to review the change.
2. Is mcpgawk free to use? Yes, the core CLI tool with local scanning, verification, and hook-based enforcement for compatible agents is free and open-source (Apache 2.0). The mcpgawk Platform (gateway tier), which provides centralized enforcement, per-agent keys, and team management, is a paid subscription with a 7-day free trial.
3. What AI agents and MCP clients does mcpgawk work with? It works with any MCP-compliant client. The free hooks integrate directly with Claude Code, Cursor, Windsurf, Codex, Gemini CLI, and Kimi. For other clients (e.g., those without a hook point), the mcpgawk Platform gateway provides a universal MCP endpoint that any client can connect to.
4. Does mcpgawk send my data or tool calls to the cloud? No. The core scanning, verification, enforcement, and decision logging all happen locally on your machine. No MCP server data, tool arguments, or call details are uploaded. The gateway tier manages policy and keys but does not intercept or log the content of tool calls.
5. Can an AI agent bypass or approve its own tool calls through mcpgawk? No. This is a fundamental security design. When a tool call is blocked, the refusal message contains no override mechanism. The mcpgawk approve command itself will refuse to run if detected inside an active AI agent session. Approval requires explicit human action via a tokened link in the terminal.