MCP Armor
Drop-in Rust sidecar for MCP servers
v0.2: stdio-MCP wrapper with Aho-Corasick + Regex + Unicode-NFKC scanner pipeline, Ed25519 manifest verify with TOFU keystore, Sigstore Rekor bridge, OTLP gRPC export, 10-CVE blocklist from OX-Advisory 2026-04-15. 9 control-plane MCP tools, 133 tests, MIT.
What it solves
An MCP client trusts the server it talks to. It trusts the tool list it is handed, it trusts the descriptions in that list, and nothing in the protocol makes the server prove who it is. Anthropic has classified those design questions as out of scope for the spec. mcp-armor implements the runtime defences that were declined there, as a sidecar that sits between the client and any upstream server.
How it works
Traffic passes through a four-stage scanner: an Aho-Corasick prefilter, a regex stage, then a normalisation pass that strips zero-width characters, bidirectional marks and unicode tags before rescanning, and finally a confusable skeleton fold that catches homoglyphs, so a Cyrillic lookalike of the word ignore no longer slips past. It validates Ed25519 manifest signatures with a trust-on-first-use keystore and a Sigstore Rekor bridge, and it strips loader-class environment keys such as LD_PRELOAD and NODE_OPTIONS from any child it spawns. Since version 0.8 it also reads every tool catalogue for instructions hidden in a tool description or its parameter schema, which is the kind of poisoning that arrives on first sight and never shows up as drift. It is a single signed Rust binary and the CI enforces a p99 budget under five milliseconds.
When to use it
Put it in front of any MCP server you did not write yourself, and in particular in front of anything you installed from a marketplace. It wraps an existing server without changing it, exports OTLP telemetry over gRPC, and keeps its block decisions in a ring buffer that a read-only control-plane server hands back to the client.
When not to use it
It guards the wire between a client and a server. It has nothing to say about what your own application does with a model response afterwards, and it is not a replacement for a policy layer inside your code. For the TypeScript side of that, ai-shield is the sister project, and the evasion patterns here were ported from it.
Stars
★ 1
installs
↓ 193
Clones (14d)
⊟ 121
Language
Rust
Tools
11
Updated
2026-08-21
Install
cargo install mcp-armor