---
title: "MCP Armor · Drop-in Rust sidecar for MCP servers"
description: "Drop-in Rust sidecar for MCP servers. v0.2: stdio-MCP wrapper with Aho-Corasick + Regex + Unicode-NFKC scanner pipeline, Ed25519 manifest verify with TOFU"
canonical: "https://matthiasmeyer.tech/repos/mcp-armor"
language: "en"
last_updated: "2026-08-21"
markdown_versions: ["https://matthiasmeyer.tech/repos/mcp-armor.md", "https://matthiasmeyer.tech/de/repos/mcp-armor.md", "https://matthiasmeyer.tech/es/repos/mcp-armor.md"]
image: "https://matthiasmeyer.tech/api/og/repo/mcp-armor?lang=en"
publisher: "Matthias Meyer, https://matthiasmeyer.tech (llms.txt: https://matthiasmeyer.tech/llms.txt)"
---

security stable Rust

# MCP Armor

Drop-in Rust sidecar for MCP servers

v0.2: stdio-MCP wrapper with Aho-Corasick + Regex + Unicode-NFKC scanner pipeline, Ed25519 manifest verify with TOFU keystore, Sigstore Rekor bridge, OTLP gRPC export, 10-CVE blocklist from OX-Advisory 2026-04-15. 9 control-plane MCP tools, 133 tests, MIT.

[View on GitHub →](https://github.com/studiomeyer-io/mcp-armor)[crates.io](https://crates.io/crates/mcp-armor)

## What it solves

An MCP client trusts the server it talks to. It trusts the tool list it is handed, it trusts the descriptions in that list, and nothing in the protocol makes the server prove who it is. Anthropic has classified those design questions as out of scope for the spec. mcp-armor implements the runtime defences that were declined there, as a sidecar that sits between the client and any upstream server.

## How it works

Traffic passes through a four-stage scanner: an Aho-Corasick prefilter, a regex stage, then a normalisation pass that strips zero-width characters, bidirectional marks and unicode tags before rescanning, and finally a confusable skeleton fold that catches homoglyphs, so a Cyrillic lookalike of the word ignore no longer slips past. It validates Ed25519 manifest signatures with a trust-on-first-use keystore and a Sigstore Rekor bridge, and it strips loader-class environment keys such as LD\_PRELOAD and NODE\_OPTIONS from any child it spawns. Since version 0.8 it also reads every tool catalogue for instructions hidden in a tool description or its parameter schema, which is the kind of poisoning that arrives on first sight and never shows up as drift. It is a single signed Rust binary and the CI enforces a p99 budget under five milliseconds.

## When to use it

Put it in front of any MCP server you did not write yourself, and in particular in front of anything you installed from a marketplace. It wraps an existing server without changing it, exports OTLP telemetry over gRPC, and keeps its block decisions in a ring buffer that a read-only control-plane server hands back to the client.

## When not to use it

It guards the wire between a client and a server. It has nothing to say about what your own application does with a model response afterwards, and it is not a replacement for a policy layer inside your code. For the TypeScript side of that, ai-shield is the sister project, and the evasion patterns here were ported from it.

Stars

★ 1

installs

↓ 193

Clones (14d)

⊟ 121

Language

Rust

Tools

11

Updated

2026-08-21

## Install

```
cargo install mcp-armor
```

## Related repos

- MCP Gauntlet

    ← pre-deploy counterpart of

    →

    https://matthiasmeyer.tech/repos/mcp-gauntlet

- SkillDoctor

    ← static-scan sibling of

    →

    https://matthiasmeyer.tech/repos/skilldoctor

- AI Shield

    → Rust counterpart of

    →

    https://matthiasmeyer.tech/repos/ai-shield

- MCP Server Attestation

    ← TS sibling of

    →

    https://matthiasmeyer.tech/repos/mcp-server-attestation

- AI Shield (Python)

    ← trio with Rust sidecar

    →

    https://matthiasmeyer.tech/repos/ai-shield-py

- MCP Stdio Shellguard

    ← TypeScript counterpart of

    →

    https://matthiasmeyer.tech/repos/mcp-stdio-shellguard

## Sitemap

Every page of this site as Markdown: [sitemap](https://matthiasmeyer.tech/sitemap.md). Curated entry point: [llms.txt](https://matthiasmeyer.tech/llms.txt).