# π‘οΈ AegisGate MCP
**Secure MCP server framework β 23 layers of defense, zero dependencies.**
*A hardened, zero-dependency MCP server written in pure Go. Build your MCP server on a foundation that has security built in from line one β not bolted on after a breach.*
Apache 2.0 Β· 23 security layers Β· 79 regex patterns + CharCNN-BiLSTM (v15) ML detection Β· Zero CVEs Β· Zero external module dependencies
[](https://github.com/aegisgatesecurity/aegisgate-mcp)
**Found AegisGate MCP useful? [Star the repo](https://github.com/aegisgatesecurity/aegisgate-mcp) β and [tell a colleague](https://x.com/intent/tweet?text=Securing%20my%20MCP%20servers%20with%20AegisGate%20%E2%80%94%2023%20security%20layers%2C%20zero%20dependencies%2C%20ML%20threat%20detection%3A%20https%3A%2F%2Fgithub.com%2Faegisgatesecurity%2Faegisgate-mcp) β it helps other devs discover secure MCP tooling.**
[](https://opensource.org/licenses/Apache-2.0)
[](https://golang.org/)
[](#changelog)
[](#test-coverage)
[](#overview)
[](#docker)
[](#ml-threat-detection-l3)
[](#build)
[](https://github.com/aegisgatesecurity/aegisgate-mcp/actions/workflows/ci.yml)
[](https://github.com/aegisgatesecurity/aegisgate-mcp/actions/workflows/security.yml)
[](#ip-notice)
[](https://mcpservers.org/servers/aegisgatesecurity/aegisgate-mcp)
[](https://registry.modelcontextprotocol.io/#/servers/io.github.aegisgatesecurity/aegisgate-mcp)
[](https://glama.ai/mcp/servers/aegisgatesecurity/aegisgate-mcp)
[Quick Start](#quick-start) Β· [Security Layers](#security-layers) Β· [RBAC](#rbac-roles) Β· [Architecture](#architecture) Β· [Protocol](#mcp-protocol-support) Β· [Docs](#documentation) Β· [Releases](https://github.com/aegisgatesecurity/aegisgate-mcp/releases)
> **AegisGate Securityβ’** is a trademark of AegisGate Security, LLC, filed with the USPTO.
> "AegisGate MCP" is an unregistered product name. See [Trademark](#trademark) below.
---
## Why AegisGate MCP?
**38% of MCP servers have no authentication. 590+ security advisories. 3 critical CVEs in the official MCP SDKs in 6 months β including CVSS 9.8 remote code execution and the "Mother of All AI Supply Chains" flaw affecting 150M+ downloads.**
The official MCP SDKs give you the protocol. They don't give you security.
No authentication. No audit logging. No threat detection. No rate limiting.
No RBAC. Every server built on a bare SDK starts with a blank security posture
and it's on you to build it β or skip it, as 38% of servers do.
**AegisGate MCP is the secure alternative.** Build your MCP server on a
foundation that has security built in from line one β not bolted on after
a breach.
| | Official MCP SDKs | AegisGate MCP |
|---|---|---|
| Authentication | β Bring your own | β
Bearer tokens + API keys + lockout |
| Authorization | β Nothing | β
4-tier RBAC with per-tool permissions |
| Audit logging | β Nothing | β
Tamper-evident SHA-256 hash chain |
| Threat detection | β Nothing | β
79 regex patterns + neural ML (<1ms) |
| Supply chain risk | β npm/PyPI deps | β
Zero dependencies (Go stdlib only) |
| CVEs | 3 critical in 6 months | Zero. Ever. |
| License | MIT | Apache 2.0 |
**23 security layers. 79 regex patterns. Zero dependencies. Zero CVEs. Apache 2.0.**
> Need proxy mode, OAuth, SIEM, or compliance frameworks? See
> [When to Upgrade to AegisGate Platform](#when-to-upgrade-to-aegisgate-platform)
> below β or explore **[AegisGate Rampart](https://github.com/aegisgatesecurity/aegisgate-rampart)**
> for local AI API proxy protection.
---
## Overview
AegisGate MCP is a hardened, zero-dependency MCP server written in pure Go.
It sits between AI agents and the tools they call, applying **23 layers of
defense** to every request β from authentication and RBAC to neural threat
detection and chain analysis.
Standard MCP servers assume a trusted local environment. In production β
whether that's a cloud SaaS platform, an enterprise data pipeline, or an
air-gapped plant network β agents may execute commands, query databases, or
interact with critical systems. A single unauthorized or malicious tool call
can cause data exfiltration, process disruption, or worse. AegisGate MCP
wraps every tool call in defense-in-depth, all with zero external module
dependencies so it can run air-gapped.
| | |
|---|---|
| **Version** | 1.6.1 |
| **License** | Apache-2.0 |
| **Go version** | 1.27+ |
| **Module deps** | Zero (no `require` directives β all third-party code vendored) |
| **Docker image** | ML: `debian:bookworm-slim` (gnutls purged), ~127 MB, 0 CVEs Β· Lite: `distroless/static-debian12`, ~10 MB, 0 CVEs |
| **Architectures** | amd64, arm64 |
| **ML model** | CharCNN-BiLSTM v15, 1.6M params, <1ms CPU inference |
| **Tests** | 611 unit/integration + 32 load/stress = 643 total, 14 benchmarks, 3 fuzz targets, 92.0% coverage (non-CGO) / 91.9% (CGO) |
---
## Quick Start
### Build
```bash
go build -o mcp-server ./cmd/mcp-server
```
### Run
```bash
# Basic TCP server on :8081
./mcp-server
# With authentication and audit logging
./mcp-server --token my-secret --audit /var/log/mcp-audit.json
# With demo tools (ping, system_info, echo)
./mcp-server --demo
# stdio mode for local MCP clients (Claude Desktop, Cursor)
./mcp-server --transport stdio --demo
# Streamable HTTP mode (MCP 2025-06-18)
./mcp-server --transport http --addr :8081 --demo
# TLS + mutual TLS
./mcp-server --tls --tls-cert server.pem --tls-key server.key --tls-client-ca ca.pem
# Config file + health endpoint
./mcp-server --config /etc/mcp/config.json --health-addr :8082
```
### Docker
```bash
# Build and run (ML-enabled, ~127 MB, 0 CVEs)
docker build --target ml -t aegisgate-mcp .
docker run -p 8081:8081 aegisgate-mcp --demo
# With authentication and audit logging
docker run -p 8081:8081 \
-e MCP_AUTH_TOKEN=your-secret-token \
-e MCP_DEMO_TOOLS=true \
aegisgate-mcp
# Distroless heuristic-only build (~10 MB, 0 CVEs, zero OS packages)
docker build --build-arg CGO_ENABLED=0 --target lite -t aegisgate-mcp:lite .
docker run -p 8081:8081 aegisgate-mcp:lite --demo
```
The ML image uses `debian:bookworm-slim` with `libgnutls30` purged (shared
libraries and dpkg metadata removed), eliminating all 6 Trivy CVEs while
keeping the glibc and ONNX Runtime dependencies required for neural
inference. The lite image is true distroless
(`gcr.io/distroless/static-debian12:nonroot`) β zero OS packages, zero
CVEs, ~10 MB. Both targets include a built-in `--health-check` flag for
Docker HEALTHCHECK (no wget/curl needed). Multi-arch builds support
both `linux/amd64` and `linux/arm64`.
### ML Threat Detection (L3)
AegisGate MCP includes the same CharCNN-BiLSTM v15 neural model used by
AegisGate Platform and Rampart β vendored with zero external module
dependencies. The model provides:
- **Semantic attack detection** β catches prompt injection and jailbreak
attempts that bypass regex pattern matching
- **Evasion resistance** β detects obfuscation techniques (leetspeak,
Unicode homoglyphs, character transposition, vowel deletion, word reversal)
- **Two-tier blocking** β scores β₯0.95 block independently; scores 0.50β0.94
block only if L1 (regex) or L2 (input scanner) corroboration is present
- **Shadow mode** β log predictions without blocking (for calibration)
- **Heuristic fallback** β when CGO is unavailable, heuristic scoring
provides baseline detection without ONNX
| Flag | Env Var | Default | Description |
|------|---------|---------|-------------|
| `--ml` | `MCP_ML_ENABLED` | `false` (CLI) / `true` (Docker) | Enable neural threat detection |
| `--ml-shadow` | `MCP_ML_SHADOW` | `false` | Log predictions but never block |
| `--ml-threshold` | `MCP_ML_THRESHOLD` | `0.50` | Threat score threshold (0.0β1.0) |
| `--ml-model` | `MCP_ML_MODEL` | `./models/threat_cnn_bilstm.onnx` | Path to ONNX model file |
### Library Usage
AegisGate MCP can be embedded as a Go library:
```go
package main
import (
"context"
"log"
mcp "github.com/aegisgatesecurity/aegisgate-mcp"
)
func main() {
cfg := mcp.DefaultServerConfig()
cfg.AuthToken = "my-secret-token"
cfg.AuditLogPath = "/var/log/mcp-audit.json"
cfg.RateLimitRPM = 120
cfg.ScanResponses = true
server, err := mcp.NewSecuredMCPServer(cfg)
if err != nil {
log.Fatal(err)
}
// Register a custom tool
// Note: tools are automatically scanned for prompt-injection poisoning
// at registration time. If the description or inputSchema contains
// malicious patterns, RegisterTool returns *ToolPoisoningError.
server.RegisterTool("my_tool", "Does something useful", 40, map[string]interface{}{
"type": "object",
"properties": map[string]interface{}{
"param1": map[string]interface{}{"type": "string"},
},
"required": []interface{}{"param1"},
})
server.RegisterToolHandler("my_tool", func(ctx context.Context, params map[string]interface{}) (interface{}, error) {
return "result", nil
})
// Register a resource (MCP resources/list, resources/read)
server.RegisterResource("config://app/info", "App Info", "App config as JSON", "application/json",
func(ctx context.Context, uri string) (*mcp.ResourceContent, error) {
return &mcp.ResourceContent{URI: uri, Text: `{"version":"1.0"}`, MimeType: "application/json"}, nil
})
// Register a prompt (MCP prompts/list, prompts/get)
server.RegisterPrompt("code_review", "Generate a code review prompt",
[]mcp.PromptArgument{{Name: "filename", Required: true}},
func(ctx context.Context, args map[string]string) (*mcp.GetPromptResult, error) {
return &mcp.GetPromptResult{
Messages: []mcp.PromptMessage{{Role: "user", Content: "Review " + args["filename"]}},
}, nil
})
// Load built-in policy rules
server.LoadDefaultPolicies()
// Start the server
if err := server.Start(context.Background()); err != nil {
log.Fatal(err)
}
defer server.Stop()
}
```
See [`examples/simple-server/`](examples/simple-server/) for a complete working example that registers a tool, resource, and prompt.
### ML Model Hot-Swap
Reload the neural threat detection model at runtime without restarting the server:
```go
// Swap to a new ONNX model file (verifies SHA-256 hash)
err := server.ReloadMLModel("/path/to/new_model.onnx")
if err != nil {
log.Printf("model reload failed: %v", err)
}
```
### Tool Poisoning Detection
All tools registered via `RegisterTool()` are automatically scanned for prompt injection in their descriptions and `inputSchema`. To scan manually:
```go
err := server.ScanToolForPoisoning("my_tool", description, inputSchema)
if err != nil {
// err is *ToolPoisoningError β do not register this tool
}
```
---
## Security Layers
AegisGate MCP applies 23 security layers to every request, in order:
| # | Layer | Description | Source |
|---|-------|-------------|--------|
| 1 | **Authentication** | Bearer token + API key, constant-time comparison, automatic lockout on repeated failures | `auth.go` |
| 2 | **Signature Verification** | ECDSA P-256 anti-forgery β verifies message signatures against trusted public keys | `auth.go` |
| 3 | **Session Management** | 256-bit cryptographically random session IDs, expiry, anti-hijacking checks | `session.go` |
| 4 | **RBAC** | 4-tier role hierarchy (restricted β standard β privileged β admin), per-tool permissions | `rbac.go` |
| 5 | **Policy Engine** | Allow/deny rules with conditions, priorities, time windows, and parameter patterns | `policy.go` |
| 6 | **Guardrails** | Per-session tool call limits and rate limiting | `guardrails.go` |
| 7 | **Chain Analysis** | Detects privilege escalation, data exfiltration chains, and repeated dangerous tool calls | `guardrails.go` |
| 8 | **Token Bucket Rate Limiting** | Sliding-window rate limiting with token bucket algorithm (RPM + burst capacity) | `guardrails.go` |
| 9 | **Input Scanning** | Scans tool *parameters* for prompt injection before execution (~79 patterns) | `handler.go`, `scanner.go` |
| 10 | **Response Scanning** | Scans tool *responses* for PII, secrets, XSS, and prompt injection (~79 detection patterns) | `scanner.go` |
| 11 | **Secret Redaction** | Scrubs sensitive data (PII, secrets) from responses before returning to the client | `scanner.go` |
| 12 | **Tool Execution Timeout** | Configurable per-call timeout prevents hanging or runaway tools | `handler.go` |
| 13 | **STDIO Validation** | Shell injection prevention via allowlist + blocklist for stdio transport commands | `stdio_guard.go` |
| 14 | **Audit Logging** | All MCP actions logged to file + in-memory, queryable for compliance, tamper-evident hash chain | `audit.go` |
| 15 | **TLS / mTLS Transport** | Encrypted TCP connections with optional mutual TLS | `config.go`, `server.go` |
| 16 | **stdio Transport** | Standard MCP client transport for Claude Desktop, Cursor, and other local integrations | `transport.go` |
| 17 | **Health Endpoint** | HTTP `/healthz`, `/readyz`, `/stats` endpoints on a separate listener | `transport.go` |
| 18 | **Parameter Validation** | Required fields checked against each tool's `inputSchema` before execution | `handler.go` |
| 19 | **Neural Threat Detection (L3)** | CharCNN-BiLSTM v15 model scores semantic attacks and evasion variants that regex misses. Two-tier blocking: β₯0.95 blocks independently, 0.50β0.94 requires L1/L2 corroboration | `internal/ml/` |
| 20 | **Heuristic Evasion Detection** | Detects transposition, vowel deletion, word reversal, leetspeak, encoding, splitting, and zero-width character obfuscation | `internal/ml/evasion_resistance.go` |
| 21 | **NFKC Unicode Normalization** | Maps Unicode compatibility characters to canonical forms before scanning β defeats homoglyph and ligature attacks (full-width `οΌ©ο½ο½ο½ο½ο½
` β `ignore`) | `internal/ml/normalizer.go` |
| 22 | **Tool Poisoning Detection** | Scans tool descriptions and `inputSchema` recursively for prompt injection (34 dangerous function patterns from AegisGate Scanner) at registration time β rejects poisoned tools before they're callable. Maps to OWASP MCP Top 10 M1 | `handler.go` |
| 23 | **Evasion Detection (L2.5)** | 15 regex patterns detecting encoding (base64, URL, unicode, HTML entities), splitting (zero-width chars, interleaving), obfuscation (leet speak, padding, markup), and semantic evasion (role-play framing, instruction override). Score β₯ 0.8 blocks independently; β₯ 0.3 logs warning. Runs between L1 regex and L3 neural detection | `internal/ml/evasion_resistance.go` |
### Detection Pattern Categories (79 patterns)
AegisGate MCP scans all tool parameters and responses with 79 regex patterns across 8 categories:
| Category | Patterns | Examples |
|----------|----------|---------|
| Prompt | 25 | Ignore-previous-instructions, role-play escalation, RAG smuggling, system prompt leakage, delimiter injection, base64 payloads |
| Dangerous Functions | 34 | eval(), exec(), os.system(), subprocess(shell=True), pickle.loads(), child_process.exec() |
| Credentials | 6 | AWS keys, GitHub PATs, JWT tokens, RSA private keys, generic API keys |
| Financial | 3 | Credit cards (Visa, Mastercard, Amex) |
| Network | 3 | Network addresses, OPC UA, Modbus, DNP3 |
| PII | 2 | SSN, email |
| XSS | 3 | Script tags, SVG onload, image onerror |
| Compliance | 3 | OWASP LLM01/02/06 |
---
## IP Notice
AegisGate's core technologies are patent pending with the USPTO (Provisional App. Nos. 64/153,573β64/153,577, filed September 12, 2026; 64/174,824, filed October 12, 2026; and 64/180,722, filed October 20, 2026). Source code is Β© 2025-2026 AegisGate Security, LLC. Licensed under Apache 2.0.
---
## Trademark
**AegisGate Securityβ’** is a trademark of AegisGate Security, LLC, filed with the
United States Patent and Trademark Office (USPTO). The mark was published for
opposition on October 13, 2026.
**AegisGate MCP** is an unregistered product name of AegisGate Security, LLC.
The β’ symbol is not used for this product name, as it has not been separately
filed as a trademark application. Use of the "AegisGate Security" mark is
governed by the Lanham Act (15 U.S.C. Β§ 1126) and applicable state trademark
law.
Permission is granted to use the AegisGate name and marks in connection with
the unmodified open-source software distribution as published on GitHub. Use
of the AegisGate name, logo, or other brand assets in derivative works,
commercial products, service offerings, or marketing materials requires prior
written permission from AegisGate Security, LLC.
Contact: legal@aegisgatesecurity.io
---
[π AegisGate Security](https://aegisgatesecurity.io) Β· [π¬ Discord](https://discord.gg/cvJ4QcY9B) Β· [βοΈ support@aegisgatesecurity.io](mailto:support@aegisgatesecurity.io) Β· [π @aegisgate](https://x.com/aegisgate) Β· [π± Telegram](https://t.me/+imsWrOY4QpcxYzIx) Β· [π @aegisgate@mastodon.social](https://mastodon.social/@aegisgate)
Made with π€ by AegisGate Security developers to secure the AI attack surface.