mcp-bastion
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| bastion__statusA | Report the health of every MCP server proxied by Bastion: which are connected, disconnected, reconnecting, or failed; how many tools each exposes; and the last error. Call this when a tool seems to be missing or a server may have dropped mid-session. |
| bastion__reconnectA | Attempt to reconnect a disconnected or failed MCP server by name. Use this after bastion status shows a server is not connected, to restore its tools without human intervention. |
| bastion__securityA | Report the security state of every proxied tool: whether its definition matches what was first approved (or changed — a possible 'rug pull'), any poisoning heuristics its description triggered, and whether another server exposes a tool with the same name (shadowing). |
| bastion__complianceA | Report an audit/compliance summary of recent tool activity, mapped to governance frameworks (NIST AI RMF functions and OWASP LLM Top 10 categories). Requires audit to be enabled. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 4 tools
Each tool has a clearly distinct purpose: status reports server connectivity health, reconnect performs a remediation action, security reports tool definition integrity and poisoning, and compliance provides audit reporting. There is no overlap in the problems they solve.
All tools use a consistent `bastion__` prefix and lowercase snake_case, which is predictable. The only minor deviation is that three names are nouns (status, security, compliance) while one is a verb (reconnect), but this does not impede understanding.
Four tools is well-scoped for a monitoring and management proxy. Each tool earns its place by addressing a distinct concern: health, remediation, security, and compliance, with no redundant or missing basics.
Core monitoring and reconnection are covered, and security/compliance reporting is present. However, there is no way to act on security findings (e.g., re-approve a changed tool definition or block a poisoned one) and no explicit server configuration management, which are minor gaps agents can work around.