MCP Action Firewall

You protect your MCP-enabled AI workflows by placing a firewall between your agent and any MCP server. The MCP Action Firewall intercepts dangerous tool calls, requires OTP-based human approval for high-risk actions, and can enforce per-server or global security policies to keep your automation safe.

How to use

You integrate the firewall by wrapping the MCP server command in front of the actual target server in your client configuration. The firewall runs as a frontend process that starts the real MCP server as a subprocess and forwards safe calls directly while pausing and prompting for approval on risky actions.

How to install

Prerequisites: ensure you have Python installed on your system.

pip install mcp-action-firewall
# or to view help and usage
uvx mcp-action-firewall --help

Configuration and usage patterns

The firewall ships with sensible defaults. You can override them with a config file passed via --config. Rules are evaluated globally first, then per-server rules, with a final fallback to the default action.

{
  "global": {
    "allow_prefixes": ["get_", "list_", "read_", "fetch_"],
    "block_keywords": ["delete", "update", "create", "pay", "send", "transfer", "drop", "remove", "refund"],
    "default_action": "block",
    "otp_attempt_count": 1
  },
  "servers": {
    "stripe": {
      "allow_prefixes": [],
      "block_keywords": ["refund", "charge"],
      "default_action": "block"
    },
    "database": {
      "allow_prefixes": ["select_"],
      "block_keywords": ["drop", "truncate", "alter"],
      "default_action": "block"
    }
  }
}

OTP flow and the pause mechanism

When a blocked tool is invoked, the firewall returns a structured response that pauses the action and asks for a four-digit approval code. The user provides the code using a dedicated confirmation tool, and, once validated, the original action proceeds.

{
  "status": "PAUSED_FOR_APPROVAL",
  "message": "⚠️ The action 'delete_user' is HIGH RISK and has been locked by the Action Firewall.",
  "action": {
    "tool": "delete_user",
    "arguments": { "id": 42 }
  },
  "instruction": "To unlock this action, you MUST ask the user for authorization.\n\n1. Show the user the following and ask for approval:\n   Tool: **delete_user**\n   Arguments:\n{\"id\": 42}\n\n2. Tell the user: 'Please reply with approval code: **9942**' to allow this action, or say no to cancel.\n3. STOP and wait for their reply.\n4. When they reply with '9942', call the 'firewall_confirm' tool with that code.\n5. If they say no or give a different code, do NOT retry."
}

The per-server confirmation tool

To complete an OTP flow, the firewall exposes a dedicated tool named firewall_confirm. Use it only after the user provides the correct code to confirm the action.

{
  "name": "firewall_confirm",
  "description": "Call this tool ONLY when the user provides the correct 4-digit approval code to confirm a paused action.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "otp": {
        "type": "string",
        "description": "The 4-digit code provided by the user."
      }
    },
    "required": ["otp"]
  }
}

Project structure and files

The project is organized to expose a Python-based CLI and a JSON-RPC style proxy that sits between your MCP client and server.

src/mcp_action_firewall/
├── __init__.py
├── __main__.py
├── server.py
├── proxy.py
├── policy.py
├── state.py
└── default_config.json

Try it — Interactive demo

Experiment with the firewall in a guided demo that shows safe calls, blocked calls, and the OTP flow without needing to configure your environment.

git clone https://github.com/starskrime/mcp-action-firewall.git
cd mcp-action-firewall
uv sync
uv run python demo.py

Known limitations and notes

Tool matching is performed on tool names only, not on argument values. For argument-level inspection, explicit per-tool rules and a strict default_block policy are recommended.

A future release plans to add argument-level inspection for deeper security checks.

Development

To contribute, install development dependencies, run tests, and exercise the firewall locally.

# Install dev dependencies
uv sync

# Run tests
uv run pytest tests/ -v

# Run the firewall locally
uv run mcp-action-firewall --target "your-server-command" -v

License

MIT licensed.

Available tools

get_balance

Query balance information from a protected data source or account.

delete_user

Remove a user record, a high-risk operation that requires OTP approval.

firewall_confirm

Submit an OTP to confirm a previously paused action.