@auth51/mcp-proxy

Least-privilege enforcement + a real audit trail at the MCP tool boundary — for AI coding agents.

Claude Code, Cursor, and Codex run with your full permissions, call MCP tools that touch repos / databases / infra / prod, and leave no record that your existing security tooling can see. A staging token with broad rights let one agent delete a production database and all backups in 9 seconds. Six disclosed exploits broke coding agents by stealing their credentials, not their models.

@auth51/mcp-proxy drops in front of any MCP server. It inspects every tools/call, blocks destructive or out-of-scope actions before they reach the tool, and writes an append-only audit log of everything the agent tried. No account required to start.

   coding agent  ──►  @auth51/mcp-proxy  ──►  your MCP server
 (Claude/Cursor)      ▲ allow / DENY + audit

Quickstart (≈ 5 minutes)

1. See it block a destructive call (no install of your own needed)

git clone <this repo> && cd auth51-mcp-proxy
npm install && npm run build
node examples/demo-drive.mjs

You'll see a safe SELECT pass through, and DROP TABLE / DELETE-without-WHERE blocked at the boundary — with the agent told exactly why, and an audit trail at .auth51/demo-audit.jsonl.

2. Guard your own MCP server

Wrap any existing MCP server entry in your client config. Before:

// .cursor/mcp.json  (or Claude Code / Codex MCP config)
{
  "mcpServers": {
    "postgres": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres", "postgres://..."]
    }
  }
}

After — insert the proxy and move the real command after --:

{
  "mcpServers": {
    "postgres": {
      "command": "npx",
      "args": [
        "-y", "@auth51/mcp-proxy",
        "--policy", "./auth51.policy.json",
        "--label", "postgres",
        "--",
        "npx", "-y", "@modelcontextprotocol/server-postgres", "postgres://..."
      ]
    }
  }
}

Restart your agent. Destructive calls are now blocked, everything is audited. That's it.

Policy

A policy is JSON: default decision plus rules. Each rule matches a tool by name (tool glob or toolMatch regex) and optionally by argument content (denyArgsMatch — regexes against the call arguments; supports a leading (?i) for case-insensitivity). First matching rule wins.

{
  "version": "1",
  "default": "allow",
  "rules": [
    {
      "id": "no-drop-or-truncate",
      "tool": "*",
      "denyArgsMatch": ["(?i)\\bdrop\\s+(table|database)\\b", "(?i)\\btruncate\\s+table\\b"],
      "reason": "Irreversible data destruction requires human approval."
    }
  ]
}

With no --policy, a conservative built-in default blocks destructive SQL, recursive rm -rf, destructive tool names, and reads of .aws/credentials / .ssh keys / .env. See examples/auth51.policy.json.

Connect to an auth51 authority (teams & enterprise)

Local mode enforces policy and audits to disk — enough for one developer. Point it at an auth51 authority and every allowed call is backed by a scoped, short-lived intent token (carrying the agent's identity + Proof-of-Possession), and decisions are centralized for your org/tenant.

export AUTH51_AUTHORITY_URL=https://authority.auth51.com
export AUTH51_CLIENT_ID=...        # your org/app API key
export AUTH51_CLIENT_SECRET=...
# add --authority to the proxy args (or set AUTH51_AUTHORITY_URL)

The authority path is fail-open in v0: local policy is always the binding enforcement point, so an authority outage can never wedge your agent. A local deny always wins.

• Individual developers: local mode, or the hosted authority (SaaS) — authority server only.
• Enterprise: the same authority self-hosted (on-prem container) or as a dedicated SaaS tenant.

CLI

auth51-mcp-proxy [options] -- <mcp-server-command> [args...]

  --policy <path>    Policy JSON (default: built-in safe defaults)
  --audit <path>     Audit log JSONL (default: ./.auth51/audit.jsonl)
  --label <name>     Friendly name for this server in logs/audit
  --agent <id>       Agent identity to attribute decisions to
  --authority <url>  auth51 authority base URL (or AUTH51_AUTHORITY_URL)

How it works

• Transparent stdio MCP proxy: spawns your server, relays JSON-RPC line-for-line.
• Only tools/call is intercepted; everything else passes through untouched.
• On tools/call: evaluate policy → allow (forward, zero added latency) or deny (return an MCP isError result explaining the block; never forward).
• Every decision is appended to the audit log; with an authority, allowed calls also mint a scoped intent token and record the decision centrally.

Status

v0. Stdio transport (the dominant local coding-agent case). HTTP/SSE transport, per-tool scope grants, and the agent-runtime identity surface are next.

License

Apache-2.0