tyga-mcp-proxy

MCP stdio proxy that sits between any MCP client and server. Intercepts tools/call messages and screens them through a multi-layer AI safety shield before execution.

Works with any MCP-compatible client: VS Code, Cursor, Windsurf, and any MCP server.

Install

npm install -g tyga-mcp-proxy

Quick Start

Add to your MCP configuration:

{
  "mcpServers": {
    "my-server": {
      "command": "tyga-mcp-proxy",
      "args": ["--api-key", "a2a_YOUR_KEY", "--", "node", "my-server.js"]
    }
  }
}

Every tools/call message is now screened before reaching your server.

How it works

1. MCP client sends a tools/call request
2. Proxy intercepts and extracts the tool arguments
3. Gate 1 (regex denylist): blocks known-dangerous patterns in <5ms
4. Gate 2 (LLM judge, Pro+): evaluates intent and risk (~180ms)
5. If allowed: request passes through to your MCP server
6. If blocked: client gets a clear error message
7. Either way: OCSF audit event recorded

Modes

Local mode (no API key): Gate 1 only. Zero latency, zero cost.

tyga-mcp-proxy -- node my-server.js

Cloud mode (with API key): Gate 1 + Gate 2 + OCSF audit.

tyga-mcp-proxy --api-key a2a_YOUR_KEY -- node my-server.js

What gets blocked

• rm -rf /, destructive filesystem operations
• curl ... | bash, remote code execution
• Credential access, privilege escalation
• Data exfiltration patterns
• 38+ denylist patterns built in

Get an API key

Sign up free at a2ainfrastructure.com. 500 evaluations/month on the free tier.

Links

• Quick Start Guide
• API Docs
• Full documentation

License

Proprietary — Tyga.Cloud Ltd. See LICENSE file.