mcps-stdio

MCPS signing proxy for stdio-based MCP servers. Wraps any stdio MCP server with ECDSA P-256 message signing, replay protection, and trust level enforcement.

Usage

npx mcps-stdio --command "node my-mcp-server.js" --port 3100 --trust-level 2

Any stdio MCP server becomes MCPS-secured:

MCP Client <--HTTP--> [mcps-stdio proxy] <--stdio--> MCP Server
                      ECDSA signing
                      Replay protection
                      Trust enforcement

Examples

# Wrap the official filesystem MCP server
npx mcps-stdio --command "npx" --args "@modelcontextprotocol/server-filesystem,/tmp" --trust-level 2

# Wrap a Python MCP server with L3 trust, require L2 minimum from clients
npx mcps-stdio --command "python" --args "mcp_server.py" --trust-level 3 --min-trust 2

# Wrap any command
npx mcps-stdio --command "./my-server" --port 4000 --trust-level 4

MCPS Response Headers

Every response includes:

| Header | Value | |--------|-------| | X-MCPS-Signature | ECDSA P-256 signature (base64) | | X-MCPS-Nonce | UUID v4 (replay protection) | | X-MCPS-Timestamp | Unix epoch ms | | X-MCPS-Trust-Level | 0-4 | | X-MCPS-KeyId | SHA-256 key fingerprint | | X-MCPS-Protocol-Version | 2025-11-25 |

Endpoints

| Path | Method | Description | |------|--------|-------------| | / | POST | JSON-RPC proxy (MCPS signed) | | /health | GET | Health + MCPS metadata | | /.well-known/mcps-keys | GET | Public signing key |

Programmatic

const { MCPSStdioProxy } = require('mcps-stdio');

const proxy = new MCPSStdioProxy({
  command: 'node',
  args: ['my-server.js'],
  port: 3100,
  trustLevel: 2,
  minTrustLevel: 0
});

proxy.start();

License

Business Source License 1.1 (BSL 1.1). See LICENSE.

• Free for non-production, evaluation, research, and development use.
• Production use requires a commercial licence from CyberSecAI Ltd. Production includes any service-of-others, paid product, or customer-facing system that embeds mcps-stdio.
• Change Date: 30 April 2030 -- converts automatically to Apache License 2.0.

Full terms, definitions, and commercial pricing (from £25,000/year per production deployment): see LICENSING.md or visit cybersecai.co.uk/licensing.

Commercial enquiries: [email protected]

Copyright (c) 2026 CyberSecAI Ltd. Raza Sharif. Patent Pending.