# Secure Enterprise Model Context Protocol Gateway (SEM-G)

![Cloudflare Workers](https://img.shields.io/badge/Cloudflare-Workers-F38020?style=for-the-badge&logo=cloudflare)
![TypeScript](https://img.shields.io/badge/TypeScript-007ACC?style=for-the-badge&logo=typescript&logoColor=white)
![Hono](https://img.shields.io/badge/Hono-E36002?style=for-the-badge)

SEM-G is a high-performance, zero-trust gateway designed to securely broker interactions between Enterprise AI Models (via the Model Context Protocol) and sensitive internal databases/tools. Built entirely on Cloudflare's Edge infrastructure using the 100% Free Tier.

![Secure Enterprise MCP](Secure.png)

## 🚀 Features

- **Zero-Trust Authorization**: Validates sessions via simulated Cloudflare Access JWTs.
- **Data Loss Prevention (DLP)**: High-speed Regex engine intercepts tool responses to mask PII (SSNs, Credit Cards, Phone Numbers) before the context reaches the AI.
- **Prompt Injection Defense**: Uses **Workers AI (`@cf/baai/bge-base-en-v1.5`)** and **Vectorize** to detect and block adversarial prompts in real-time.
- **LLM-as-a-Judge**: Leverages a fast evaluation model (`@cf/meta/llama-3-8b-instruct`) to score finalized context blocks for safety and alignment before returning payloads over Streamable HTTP `/mcp`.
- **Edge Native**: Stateless architecture utilizing **Cloudflare KV** for sub-millisecond session governance and rate limiting.

## 🛠️ Architecture

1. **Routing Layer**: Hono.js manages API endpoints securely.
2. **Session Governance**: Cloudflare KV tracks transactions to prevent abuse.
3. **Security Middleware**: Embeddings and Vector Search classify inputs.
4. **Tool Execution**: Handles standard JSON-RPC 2.0 requests following the MCP specification.

## 📦 Getting Started

### Prerequisites
- Node.js & npm
- A Cloudflare Account (Free Tier is sufficient)
- [Wrangler CLI](https://developers.cloudflare.com/workers/wrangler/install-and-update/) installed globally.

### Installation

1. Clone the repository and install dependencies:
   ```bash
   npm install
   ```

2. Login to Cloudflare:
   ```bash
   npx wrangler login
   ```

3. Provision Cloudflare Resources:
   Create the required KV Namespace and Vectorize database for your project:
   ```bash
   npx wrangler kv:namespace create "SESSION_STORE"
   npx wrangler vectorize create threat-signatures --dimensions=768 --metric=cosine
   ```
   *Note: Update the IDs inside your `wrangler.jsonc` file with the outputs from the above commands.*

4. Run Locally (Development):
   ```bash
   npm run dev
   ```

## 🧪 Testing

The test suite validates DLP masking patterns and routing authorization natively inside a simulated Cloudflare Edge environment.
```bash
npm run test
```

## 🚀 Deployment

Deploy globally to the Cloudflare Edge network:
```bash
npm run deploy
```

## 🔐 Security Notice
This is a demonstration of enterprise concepts adapted for the Cloudflare Free Tier. In a true enterprise setting, it is recommended to use **Cloudflare Access** for verifying JWTs via JWKS, and utilizing robust ML/NER models for DLP masking rather than pure regular expressions.

---