Secure Enterprise Model Context Protocol Gateway (SEM-G)

SEM-G is a high-performance, zero-trust gateway designed to securely broker interactions between Enterprise AI Models (via the Model Context Protocol) and sensitive internal databases/tools. Built entirely on Cloudflare's Edge infrastructure using the 100% Free Tier.

🚀 Features

• Zero-Trust Authorization: Validates sessions via simulated Cloudflare Access JWTs.

• Data Loss Prevention (DLP): High-speed Regex engine intercepts tool responses to mask PII (SSNs, Credit Cards, Phone Numbers) before the context reaches the AI.

• Prompt Injection Defense: Uses Workers AI (@cf/baai/bge-base-en-v1.5) and Vectorize to detect and block adversarial prompts in real-time.

• LLM-as-a-Judge: Leverages a fast evaluation model (@cf/meta/llama-3-8b-instruct) to score finalized context blocks for safety and alignment before returning payloads over Streamable HTTP /mcp.

• Edge Native: Stateless architecture utilizing Cloudflare KV for sub-millisecond session governance and rate limiting.

Related MCP server: MCPGuard

🛠️ Architecture

1. Routing Layer: Hono.js manages API endpoints securely.

2. Session Governance: Cloudflare KV tracks transactions to prevent abuse.

3. Security Middleware: Embeddings and Vector Search classify inputs.

4. Tool Execution: Handles standard JSON-RPC 2.0 requests following the MCP specification.

📦 Getting Started

Prerequisites

• Node.js & npm

• A Cloudflare Account (Free Tier is sufficient)

• Wrangler CLI installed globally.

Installation

1. Clone the repository and install dependencies:

   npm install

2. Login to Cloudflare:

   npx wrangler login

3. Provision Cloudflare Resources: Create the required KV Namespace and Vectorize database for your project:

   npx wrangler kv:namespace create "SESSION_STORE"
   npx wrangler vectorize create threat-signatures --dimensions=768 --metric=cosine

   Note: Update the IDs inside your wrangler.jsonc file with the outputs from the above commands.

4. Run Locally (Development):

   npm run dev

🧪 Testing

The test suite validates DLP masking patterns and routing authorization natively inside a simulated Cloudflare Edge environment.

npm run test

🚀 Deployment

Deploy globally to the Cloudflare Edge network:

npm run deploy

🔐 Security Notice

This is a demonstration of enterprise concepts adapted for the Cloudflare Free Tier. In a true enterprise setting, it is recommended to use Cloudflare Access for verifying JWTs via JWKS, and utilizing robust ML/NER models for DLP masking rather than pure regular expressions.