MCP RCE Guard
Layer-3 RCE defense for MCP servers via policy synthesis
Foundation pillar 9. Closes the tool-injection-RCE class that sidecar scanners (mcp-armor) and stdio wrappers (mcp-stdio-shellguard) cannot catch. Synthesises per-tool policies from declared semantics and enforces them at execution time. MIT, TypeScript.
What it solves
An MCP server that spawns a subprocess has, in that moment, handed over whatever the host process is allowed to do. There is no standard way to write down what that subprocess may read, write, spawn or talk to, so in practice nobody writes it down at all. This library gives that a typed, validated shape.
How it works
It emits isolation policy descriptors for the three platforms that have them: landlock profiles for Linux 5.13 and newer, sandbox-exec Scheme profiles for macOS, and cgroups-v2 specs for memory, process count and CPU. Alongside that sit behavioural predicates that scan a subprocess command for the shape of known RCE vulnerabilities, including the MCP SDK issue of April 2026, CVE-2026-27124, the Nginx MCP case and interpreter inline-eval sinks such as node -e or python -c. Exact-token matching keeps benign launch flags out of the findings. Network egress is default-deny with wildcard, exact, suffix and port matching, and every isolation decision is appended to an NDJSON audit log.
When to use it
Take it if you are building the host side and want a reproducible description of what a subprocess may do, plus a scanner that recognises known vulnerability shapes before you ship. The canary tokens are the other half: issue one, then watch downstream output, file writes and network traffic for it to reappear.
When not to use it
The README is blunt about this and so is this page: version 0.1 emits descriptors, it does not apply them. Nothing here makes a syscall, so it will not contain a hostile subprocess at the kernel boundary on its own. The host has to translate a descriptor into the platform call, and the enforcement helper that does that is the 0.2 tranche. The audit log also ships unsigned for now.
Stars
★ 0
installs
↓ 440
Clones (14d)
⊟ 25
Language
TypeScript
Updated
2026-08-21
Install
npx -y mcp-rce-guard