Code Firewall MCP
Integrates with Ollama to generate structural embeddings of code syntax trees, enabling similarity-based detection and blocking of dangerous code patterns.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Code Firewall MCPcheck if script.py is safe to execute"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Code Firewall MCP
A structural similarity-based code security filter for MCP (Model Context Protocol). Blocks dangerous code patterns before they reach execution tools by comparing code structure against a blacklist of known-bad patterns.
How It Works
flowchart LR
A[Code<br/>file/string] --> B[Parse & Normalize<br/>tree-sitter]
B --> C[Embed<br/>Ollama]
C --> D{Similarity Check<br/>vs Blacklist}
D -->|β₯ threshold| E[π« BLOCKED]
D -->|< threshold| F[β
ALLOWED]
F --> G[Execution Tools<br/>rlm_exec, etc.]
style E fill:#ff6b6b,color:#fff
style F fill:#51cf66,color:#fff
style D fill:#339af0,color:#fffParse code to Concrete Syntax Tree (CST) using tree-sitter
Normalize by stripping identifiers and literals β structural skeleton
Embed the normalized structure via Ollama
Compare against blacklisted patterns in ChromaDB
Block if similarity exceeds threshold, otherwise allow
Related MCP server: Agent Guards β deterministic security tools for AI agents
Key Insight
Code patterns like os.system("rm -rf /") and os.system("ls") have identical structure. By normalizing away the specific commands/identifiers, we can detect dangerous patterns regardless of the specific arguments used.
Security-sensitive identifiers are preserved during normalization (e.g., eval, exec, os, system, subprocess, Popen, shell) to ensure embeddings remain discriminative for dangerous patterns.
Installation
Quick Start
Option 1: PyPI (Recommended)
uvx code-firewall-mcp
# or
pip install code-firewall-mcpOption 2: Claude Desktop One-Click
Download the .mcpb from Releases and double-click to install.
Option 3: From Source
git clone https://github.com/egoughnour/code-firewall-mcp.git
cd code-firewall-mcp
uv syncWire to Claude Code / Claude Desktop
Add to ~/.claude/.mcp.json (Claude Code) or claude_desktop_config.json (Claude Desktop):
{
"mcpServers": {
"code-firewall": {
"command": "uvx",
"args": ["code-firewall-mcp"],
"env": {
"FIREWALL_DATA_DIR": "~/.code-firewall",
"OLLAMA_URL": "http://localhost:11434"
}
}
}
}Requirements
Python 3.10+ (< 3.14 due to onnxruntime compatibility)
Ollama (for embeddings)
ChromaDB (for vector storage)
tree-sitter (optional, for better parsing)
Setting Up Ollama (Embeddings)
Code Firewall can automatically install and configure Ollama on macOS with Apple Silicon. There are two installation methods:
Method 1: Homebrew Installation
# 1. Check system requirements
firewall_system_check()
# 2. Install via Homebrew
firewall_setup_ollama(install=True, start_service=True, pull_model=True)What this does:
Installs Ollama via Homebrew (
brew install ollama)Starts Ollama as a managed background service
Pulls nomic-embed-text model for embeddings
Method 2: Direct Download (No Sudo)
# 1. Check system
firewall_system_check()
# 2. Install via direct download - no sudo, no Homebrew
firewall_setup_ollama_direct(install=True, start_service=True, pull_model=True)What this does:
Downloads Ollama from https://ollama.com
Extracts to
~/Applications/(no admin needed)Starts Ollama via
ollama servePulls nomic-embed-text model
Manual Setup
# Install Ollama
brew install ollama
# or download from https://ollama.ai
# Start service
brew services start ollama
# or: ollama serve
# Pull embedding model
ollama pull nomic-embed-text
# Verify
firewall_ollama_status()Tools
Setup & Status Tools
Tool | Purpose |
| Check system requirements β verify macOS, Apple Silicon, RAM |
| Install via Homebrew β managed service, auto-updates |
| Install via direct download β no sudo, fully headless |
| Check Ollama availability β verify embeddings are ready |
Firewall Tools
Tool | Purpose |
| Check if a code file is safe to execute |
| Check code string directly (no file required) |
| Add a dangerous pattern to the blacklist |
| Record near-miss variants for classifier sharpening |
| List patterns in blacklist or delta collection |
| Remove a pattern from blacklist or deltas |
| Get firewall status and statistics |
firewall_check
Check if a code file is safe to pass to execution tools.
result = await firewall_check(file_path="/path/to/script.py")
# Returns: {allowed: bool, blocked: bool, similarity: float, ...}firewall_check_code
Check code string directly (no file required).
result = await firewall_check_code(
code="import os; os.system('rm -rf /')",
language="python"
)firewall_blacklist
Add a dangerous pattern to the blacklist.
result = await firewall_blacklist(
code="os.system(arbitrary_command)",
reason="Arbitrary command execution",
severity="critical"
)firewall_record_delta
Record near-miss variants to sharpen the classifier.
result = await firewall_record_delta(
code="subprocess.run(['ls', '-la'])",
similar_to="abc123",
notes="Legitimate use case for file listing"
)firewall_list_patterns
List patterns in the blacklist or delta collection.
firewall_remove_pattern
Remove a pattern from blacklist or deltas.
firewall_status
Get firewall status and statistics.
Configuration
Environment variables:
Variable | Default | Description |
|
| Data storage directory |
|
| Ollama server URL |
|
| Ollama embedding model |
|
| Block threshold (0-1) |
|
| Near-miss recording threshold |
Usage Pattern
Pre-filter for massive-context-mcp
Use code-firewall-mcp as a gatekeeper before passing code to rlm_exec:
# 1. Check code safety
check = await firewall_check_code(user_code)
if check["blocked"]:
print(f"BLOCKED: {check['reason']}")
return
# 2. If allowed, proceed with execution
result = await rlm_exec(code=user_code, context_name="my-context")Integrated with massive-context-mcp
Install massive-context-mcp with firewall integration:
pip install massive-context-mcp[firewall]When enabled, rlm_exec automatically checks code against the firewall before execution.
Building the Blacklist
The blacklist grows through use:
Initial seeding: Add known dangerous patterns
Audit feedback: When
rlm_auto_analyzefinds security issues, add patternsDelta sharpening: Record near-misses to improve classification boundaries
# After security audit finds issues
await firewall_blacklist(
code=dangerous_code,
reason="Command injection via subprocess",
severity="critical"
)Structural Normalization
flowchart TD
subgraph Input
A1["os.system('rm -rf /')"]
A2["os.system('ls -la')"]
A3["os.system(user_cmd)"]
end
subgraph Normalization
B[Strip literals & identifiers<br/>Preserve security keywords]
end
subgraph Output
C["os.system('S')"]
end
A1 --> B
A2 --> B
A3 --> B
B --> C
style C fill:#ff922b,color:#fffThe normalizer strips:
Identifiers:
my_varβ_(except security-sensitive ones)String literals:
"hello"β"S"Numbers:
42βNComments: Removed entirely
Preserved identifiers (for better pattern matching):
eval,exec,compile,__import__os,system,popen,subprocess,Popen,shellopen,read,write,socket,connectgetattr,setattr,__globals__,__builtins__And more security-sensitive names...
Example:
# Original
subprocess.run(["curl", url, "-o", output_file])
# Normalized (preserves 'subprocess' and 'run')
subprocess.run(["S", _, "S", _])Both subprocess.run(["curl", ...]) and subprocess.run(["wget", ...]) normalize to the same structure, so blacklisting one catches both.
License
MIT
Available Tools
11 toolsfirewall_blacklistA
Add a code pattern to the blacklist.
Either file_path or code must be provided.
Args: file_path: Path to code file to blacklist code: Code string to blacklist (alternative to file_path) reason: Why this pattern is dangerous severity: critical, high, medium, low language: Programming language (used if code is provided)
Returns: {"status": "added", "pattern_id": str, "structure_hash": str}
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | No | ||
| code | No | ||
| reason | No | Security risk | |
| severity | No | high | |
| language | No | python |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It implies a mutation operation ('Add') and specifies required parameters, but doesn't cover important aspects like permissions needed, rate limits, whether the addition is permanent or reversible, or how the blacklist affects system behavior. The description adds basic context but misses key behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the core purpose, followed by parameter explanations and return format. Every sentence earns its place: the first states the action, the second clarifies parameter requirements, and the Args/Returns sections are concise and informative without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the mutation nature (no annotations), 5 parameters with 0% schema coverage, and an output schema provided, the description does a good job. It explains parameters thoroughly and includes return values, though it could better address behavioral aspects like system impact or error conditions. The output schema reduces the need for return value details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must compensate. It provides clear semantics for all 5 parameters: 'file_path' and 'code' are explained as alternatives, 'reason' as justification, 'severity' with enumerated values, and 'language' as programming context. This adds significant meaning beyond the bare schema, though it doesn't detail format constraints (e.g., path syntax).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Add a code pattern to the blacklist') and resource ('blacklist'), distinguishing it from siblings like 'firewall_remove_pattern' (removal) and 'firewall_list_patterns' (listing). The verb 'Add' is precise and the resource 'blacklist' is well-defined.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides some implied usage guidance by stating 'Either file_path or code must be provided,' which helps differentiate between input methods. However, it lacks explicit guidance on when to use this tool versus alternatives like 'firewall_check' or 'firewall_check_code,' and doesn't mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_checkA
Check if code is safe to pass to execution tools like rlm_exec.
Parses the code, normalizes to structural skeleton, embeds via Ollama, and checks similarity against blacklisted dangerous patterns.
Args: file_path: Path to the code file to check
Returns: { "allowed": bool, # True if safe to proceed "blocked": bool, # True if matched blacklist "similarity": float, # Similarity to closest blacklist match (0-1) "matched_pattern": str, # ID of matched pattern (if blocked) "reason": str, # Why it was blocked (if blocked) "near_miss": bool, # True if close but not blocked "structure_hash": str, # Hash of normalized structure }
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure and does so effectively. It describes the multi-step process (parsing, normalizing, embedding, similarity checking), mentions the use of Ollama embeddings, and references blacklisted dangerous patterns. It doesn't cover rate limits, authentication needs, or error conditions, but provides substantial operational context for a security tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly structured and front-loaded: the first sentence states the core purpose, followed by a concise process overview, then clearly labeled parameter and return value sections. Every sentence earns its place with no wasted words, making it easy for an agent to quickly understand the tool's function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's security-critical nature, single parameter, and comprehensive output schema, the description is complete. It explains the purpose, process, parameter meaning, and the output schema fully documents return values. No annotations exist to supplement, but the description stands adequately on its own for this complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage for its single parameter, but the description's 'Args' section clearly explains 'file_path: Path to the code file to check'. This adds essential meaning beyond the bare schema. The description doesn't specify format requirements or constraints, but provides the fundamental semantic understanding needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('check if code is safe', 'parses', 'normalizes', 'embeds', 'checks similarity') and resources ('code', 'execution tools like rlm_exec'). It explicitly distinguishes from siblings by focusing on safety checking rather than blacklist management, pattern listing, or system status operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool ('check if code is safe to pass to execution tools like rlm_exec'), which implicitly suggests it should be used before executing untrusted code. However, it doesn't explicitly state when NOT to use it or name specific alternative tools among the many siblings, though the purpose differentiation is strong enough to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_check_codeB
Check if code string is safe (without requiring a file).
Args: code: The code to check language: Programming language (default: python)
Returns: Same as firewall_check
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | ||
| language | No | python |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It mentions the tool checks safety but doesn't disclose what 'safe' means, potential side effects (e.g., rate limits, authentication needs), or behavioral traits like whether it's read-only or destructive. The reference to 'Same as firewall_check' is vague and doesn't add concrete behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded with the core purpose. The Args and Returns sections are structured but could be more integrated; the 'Same as firewall_check' is somewhat vague and doesn't fully earn its place. Overall, it's efficient with minimal waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 parameters with 0% schema coverage and an output schema exists, the description provides basic purpose and parameter hints but lacks details on safety criteria, error handling, or output specifics. It's minimally adequate for a simple check tool but has clear gaps in behavioral and parameter context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds meaning by explaining 'code' as the code to check and 'language' as the programming language with a default, which clarifies beyond the bare schema. However, it doesn't specify allowed languages, code format constraints, or other parameter details, leaving gaps in documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks if a code string is safe, specifying it works without requiring a file. It distinguishes from siblings like firewall_check (which likely requires a file) by emphasizing the string-based approach. However, it doesn't explicitly differentiate from other safety-related siblings like firewall_blacklist or firewall_list_patterns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you have code as a string rather than a file, suggesting an alternative to file-based checking. However, it doesn't provide explicit guidance on when to use this versus other safety tools like firewall_blacklist or firewall_system_check, nor does it mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_list_patternsB
List patterns in the blacklist or delta collection.
Args: collection_name: "blacklist" or "deltas" limit: Maximum number of patterns to return
Returns: {"patterns": [...], "count": int}
| Name | Required | Description | Default |
|---|---|---|---|
| collection_name | No | blacklist | |
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions the return format but lacks critical behavioral details such as whether this is a read-only operation, if it requires authentication, how it handles errors, or if there are rate limits. For a tool with no annotation coverage, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly concise and well-structured: a clear purpose statement followed by formatted sections for Args and Returns. Every sentence earns its place, with no wasted words, making it easy to scan and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity, 2 parameters, no annotations, but an output schema provided, the description is reasonably complete. It covers purpose, parameters, and return values, though it could improve by adding behavioral context like safety or usage guidelines relative to siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context beyond the input schema, which has 0% coverage. It explains that 'collection_name' accepts 'blacklist' or 'deltas' and 'limit' specifies the maximum number of patterns, clarifying usage that the schema alone doesn't provide. With 2 parameters and low schema coverage, this compensates well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'patterns in the blacklist or delta collection', making the purpose specific and understandable. However, it doesn't explicitly differentiate from sibling tools like 'firewall_blacklist' or 'firewall_record_delta', which might have overlapping functionality, preventing a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With siblings like 'firewall_blacklist' and 'firewall_record_delta' that might handle similar collections, there's no indication of context, prerequisites, or exclusions, leaving usage ambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_ollama_statusA
Check Ollama server status and embedding model availability.
Args: force_refresh: Force refresh the cached status
| Name | Required | Description | Default |
|---|---|---|---|
| force_refresh | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions checking server status and model availability, which implies a read-only operation, but doesn't detail aspects like authentication needs, rate limits, or what 'availability' entails (e.g., uptime, load). It adds some context but lacks comprehensive behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, with the core purpose stated first and parameter details following in a clear, bullet-like format. Every sentence earns its place without redundancy, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (1 parameter, no annotations, but with an output schema), the description is reasonably complete. It covers the purpose and parameter semantics adequately, and since an output schema exists, it doesn't need to explain return values. However, it could improve by addressing sibling differentiation or more behavioral details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful semantics for the single parameter 'force_refresh' by explaining it 'Force refresh the cached status,' which clarifies its purpose beyond the schema's basic boolean type. Since schema description coverage is 0%, this compensates well, though it doesn't cover all potential nuances like caching behavior details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose as 'Check Ollama server status and embedding model availability,' which is a specific verb+resource combination. However, it doesn't explicitly differentiate from sibling tools like 'firewall_status' or 'firewall_system_check,' which likely have overlapping monitoring functions, preventing a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools or contexts where this specific status check is preferred, such as for embedding models versus general firewall status, leaving the agent with minimal usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_record_deltaA
Record a near-miss variant to help sharpen the classifier.
Use this when code is similar to a blacklisted pattern but represents a legitimate use case, or when a new variant of a dangerous pattern is discovered.
Args: file_path: Path to code file code: Code string (alternative to file_path) similar_to: Pattern ID this is similar to notes: Notes about why this is being recorded language: Programming language
Returns: {"status": "recorded", "delta_id": str}
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | No | ||
| code | No | ||
| similar_to | No | ||
| notes | No | ||
| language | No | python |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It describes the tool's purpose and usage context well but lacks details on behavioral traits like authentication requirements, rate limits, or what 'recording' entails (e.g., storage, visibility, or impact on the classifier). The description doesn't contradict annotations (none provided), but it's incomplete for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded: the first sentence states the purpose, followed by usage guidelines, then a structured Args/Returns section. Every sentence earns its place with no redundancy, making it efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (mutation with 5 parameters, no annotations), the description is mostly complete: it covers purpose, usage, parameters, and includes an output schema (returns status and delta_id). However, it lacks details on behavioral aspects like permissions or effects, which are important for a mutation tool. The output schema reduces the need to explain return values, but more context on the tool's impact would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates by listing all 5 parameters (file_path, code, similar_to, notes, language) and explaining their semantics briefly (e.g., 'Path to code file', 'Code string (alternative to file_path)'). This adds significant value beyond the bare schema, though it doesn't detail constraints or interactions between parameters like file_path vs. code.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('Record a near-miss variant') and resource ('to help sharpen the classifier'), distinguishing it from siblings like blacklisting or checking tools. It explains this is for legitimate use cases similar to blacklisted patterns or new dangerous pattern variants, providing precise differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: 'Use this when code is similar to a blacklisted pattern but represents a legitimate use case, or when a new variant of a dangerous pattern is discovered.' This provides clear context and distinguishes it from alternatives like blacklisting or removal tools among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_remove_patternC
Remove a pattern from the blacklist or delta collection.
Args: pattern_id: The pattern ID to remove collection_name: "blacklist" or "deltas"
Returns: {"status": "removed", "pattern_id": str}
| Name | Required | Description | Default |
|---|---|---|---|
| pattern_id | Yes | ||
| collection_name | No | blacklist |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('Remove') and the return value, but doesn't cover critical aspects like permissions needed, whether the removal is reversible, potential side effects, or error handling. This is inadequate for a mutation tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, with the core purpose stated first, followed by structured sections for Args and Returns. There's no wasted text, though the structure could be slightly more integrated for optimal flow.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (a mutation with 2 parameters), no annotations, and an output schema that covers return values, the description is partially complete. It explains the action and parameters but lacks behavioral context and usage guidelines, making it adequate but with clear gaps for an agent to operate effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains 'pattern_id' as 'The pattern ID to remove' and 'collection_name' as '"blacklist" or "deltas"', adding meaning beyond the bare schema. However, it doesn't detail format constraints or examples, leaving some gaps in parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Remove a pattern') and the target ('from the blacklist or delta collection'), which is specific and unambiguous. However, it doesn't explicitly differentiate this tool from sibling tools like 'firewall_blacklist' or 'firewall_record_delta', which might handle similar collections, so it doesn't reach the highest score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, such as other sibling tools like 'firewall_blacklist' or 'firewall_record_delta'. It mentions the collections ('blacklist' or 'deltas') but doesn't explain the context or prerequisites for removal, leaving usage unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_setup_ollamaB
Install Ollama via Homebrew (macOS).
Args: install: Install Ollama via Homebrew start_service: Start Ollama as a background service pull_model: Pull the embedding model (nomic-embed-text) model: Model to pull (default: nomic-embed-text)
| Name | Required | Description | Default |
|---|---|---|---|
| install | No | ||
| start_service | No | ||
| pull_model | No | ||
| model | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions installation and service management actions but lacks critical details like required permissions, side effects (e.g., system changes), error handling, or confirmation of success/failure states, which are essential for a setup tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with a clear opening sentence followed by a bullet-point list of parameters, each with brief explanations. Every sentence earns its place without redundancy, making it easy to scan and understand.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (setup operations with multiple steps), no annotations, and an output schema (which should cover return values), the description is moderately complete. It outlines the main actions but misses operational details like platform limitations beyond macOS, error scenarios, or integration with sibling tools, leaving gaps for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaningful context for all four parameters beyond the input schema, which has 0% description coverage. It explains what each boolean flag does (install, start_service, pull_model) and provides a default value for the model parameter, compensating well for the schema's lack of documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool installs Ollama via Homebrew on macOS, specifying the verb (install), resource (Ollama), and platform constraint. However, it doesn't explicitly differentiate from its sibling 'firewall_setup_ollama_direct', which appears to serve a similar purpose, preventing a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'firewall_setup_ollama_direct' or other setup methods. It lists parameters but doesn't explain prerequisites, dependencies, or typical workflows, leaving usage context unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_setup_ollama_directA
Install Ollama via direct download (macOS) - no Homebrew, no sudo.
Args: install: Download and install Ollama to ~/Applications start_service: Start Ollama server in background pull_model: Pull the embedding model (nomic-embed-text) model: Model to pull (default: nomic-embed-text)
| Name | Required | Description | Default |
|---|---|---|---|
| install | No | ||
| start_service | No | ||
| pull_model | No | ||
| model | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It describes installation location (~/Applications) and background server startup, but doesn't mention permission requirements, error handling, what happens if installation fails, or system impact. For a setup tool with zero annotation coverage, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with a clear purpose statement followed by parameter explanations. Every sentence adds value, though the parameter section could be slightly more concise. The information is appropriately front-loaded with the main purpose first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (which handles return values), no annotations, and the description provides good parameter semantics despite 0% schema coverage, the description is reasonably complete. It covers the main purpose, platform constraints, and parameter meanings, though additional behavioral context would improve completeness for a setup tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description provides meaningful parameter documentation that compensates well. It explains what each boolean parameter does (download/install, start server, pull model) and provides the default model value. However, it doesn't explain parameter interactions or dependencies between install/start_service/pull_model.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action (install Ollama via direct download), the target platform (macOS), and distinguishes it from alternatives (no Homebrew, no sudo). It explicitly differentiates from the sibling tool 'firewall_setup_ollama' by specifying the direct download method.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context about when to use this tool (macOS installation without Homebrew or sudo), but doesn't explicitly state when NOT to use it or mention specific alternatives beyond the implied sibling tool. It gives good platform and method guidance but lacks explicit exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_statusB
Get firewall status and statistics.
Returns: { "ollama_available": bool, "chromadb_available": bool, "tree_sitter_available": bool, "blacklist_count": int, "delta_count": int, "similarity_threshold": float, "near_miss_threshold": float, }
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. While it mentions that the tool 'returns' specific data, it doesn't describe any behavioral traits such as whether this is a read-only operation, if it requires authentication, potential rate limits, or error conditions. The description is minimal and lacks context beyond the basic output structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and well-structured. It uses only two sentences: one to state the purpose and another to detail the return format. Every word earns its place, with no redundant or unnecessary information. The output details are clearly formatted, making it easy for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is an output schema (implied by the detailed return structure in the description), the description doesn't need to explain return values further. However, for a tool with no annotations and multiple sibling tools, it lacks context about when to use it and behavioral aspects. The description is adequate but has clear gaps in guidance and transparency.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so no parameter documentation is needed. The description appropriately doesn't discuss parameters, focusing instead on the output. This meets the baseline expectation for tools with no parameters, as it doesn't waste space on irrelevant details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get firewall status and statistics.' This is a specific verb+resource combination that tells the agent exactly what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'firewall_system_check' or 'firewall_ollama_status,' which likely provide overlapping or related status information.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With multiple sibling tools related to firewall status (e.g., firewall_system_check, firewall_ollama_status), the agent receives no indication of what makes this tool distinct or when it should be preferred over others. The description merely states what it does, not when to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firewall_system_checkA
Check if system meets requirements for Ollama embeddings.
Verifies: macOS, Apple Silicon (M1/M2/M3/M4), RAM, Homebrew installed. Use before attempting Ollama setup.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It describes what gets verified (macOS, Apple Silicon, RAM, Homebrew) but doesn't mention what happens if requirements aren't met, whether it requires specific permissions, or what the output format looks like. The description adds some behavioral context but leaves significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly concise with two sentences that each earn their place. The first sentence states the purpose and verification criteria, while the second provides clear usage guidance. No wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simple nature (0 parameters, has output schema), the description provides adequate context about what it does and when to use it. However, with no annotations and a verification tool that could have edge cases, it could benefit from more detail about failure modes or output interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters with 100% schema description coverage, so the baseline is 4. The description appropriately doesn't discuss parameters since none exist, focusing instead on the tool's purpose and usage context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Check if system meets requirements') and the target resource ('Ollama embeddings'), with explicit verification criteria listed. It distinguishes itself from siblings like 'firewall_setup_ollama' by focusing on pre-setup verification rather than installation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('Use before attempting Ollama setup'), providing clear context for its application. It differentiates from alternatives by positioning itself as a prerequisite check rather than a setup or status tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Most tools have distinct purposes, but firewall_check and firewall_check_code are very similarβboth check code safety, differing only in input method (file vs. string). This could cause confusion, though their descriptions clarify the distinction. Other tools like blacklist, remove_pattern, and status are clearly differentiated.
All tool names follow a consistent 'firewall_' prefix with descriptive suffixes in snake_case, such as firewall_blacklist, firewall_check, and firewall_status. This pattern is uniform across all 11 tools, making them predictable and easy to identify.
With 11 tools, the count is well-suited for a code firewall server, covering core operations like blacklisting, checking, setup, and status. Each tool serves a specific role in the domain, avoiding redundancy while providing comprehensive functionality.
The toolset covers key aspects of a code firewall: blacklist management (add, list, remove), safety checks (file and code variants), setup (Ollama installation), and status monitoring. A minor gap is the lack of a tool to update existing patterns, but agents can work around this by removing and re-adding.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Security firewall for AI agents β scans MCP calls for injection, secrets, and risks.
The WAF for agents. Pattern-based + heuristic firewall scans prompts, RAG documents, tool argume...
Formally-verified injection/exfiltration detector for AI agents (MCP-02).
Deterministic prompt-injection detector; signed, offline-verifiable verdicts. Not an LLM.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenancePre-transaction security gate for Pharos AI agents that analyzes contract bytecode and on-chain state to assess risks like upgradeability and honeypot controls.
- AlicenseNot gradedqualityBmaintenanceInput/output safety gate for AI agents: detect prompt-injection/jailbreak, leaked secrets/PII, and URL/IP reputation. Deterministic, no LLM.427MIT
- AlicenseNot gradedqualityAmaintenanceA local-first MCP safety layer that blocks dangerous files and redacts secrets before AI agents can access them, ensuring safe vibe coding.13Apache 2.0
- AlicenseNot gradedqualityCmaintenanceA safety guard for AI assistants that inspects actions (file reads, queries, etc.) and classifies them as SAFE, SUSPICIOUS, or BLOCK with explanations, using both known-attack patterns and behavior-based zero-day detection.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/egoughnour/code-firewall-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server