# 🛡️ fast-mcp-gatekeeper

> **The Zero-Latency Security & Policy Proxy for Model Context Protocol (MCP)**  
> Powered by TypeSafe AI's **Jev** System 1 Decision Model.

[![npm version](https://img.shields.io/badge/npm-v1.0.0-blue.svg)](https://npmjs.org)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![Powered by Jev](https://img.shields.io/badge/Model-Jev%20System%201-purple.svg)](https://typesafe.ai)

As coding assistants (Cursor, Claude Desktop, Antigravity) gain access to local tools via the **Model Context Protocol (MCP)**, granting unconstrained access to your filesystem, terminal, and database is risky.

Existing security checks run through heavy LLMs add **2,000–3,000ms** of latency to *every single tool call*, crippling agent responsiveness.

**`fast-mcp-gatekeeper`** acts as an ultra-fast stdio proxy sitting between your MCP client and any MCP server. It inspects all JSON-RPC `tools/call` packets in **<50 milliseconds**, detecting path traversals, command injections, and credential leaks without slowing down your AI workflow.

---

## ✨ Features

- ⚡ **Sub-50ms Overhead:** Jev evaluates tool arguments in a single non-autoregressive pass.
- 🛑 **Automatic Interception:** Returns standard MCP JSON-RPC `-32001` error codes before the downstream tool can ever execute.
- 🔑 **Automatic Token Sanitization:** Redacts leaked API keys (`sk-...`, Bearer tokens, passwords) on the fly with the `redact` policy.
- 🔌 **Universal Compatibility:** Works with any stdio-based MCP server (e.g. `@modelcontextprotocol/server-filesystem`, Postgres, Git, GitHub).

---

## 🚀 Quick Setup with Claude Desktop or Cursor

In your `claude_desktop_config.json` or Cursor MCP settings, simply prepend `fast-mcp-gatekeeper --` to your server command:

```json
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "fast-mcp-gatekeeper",
        "--",
        "npx",
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/username/workspace"
      ]
    }
  }
}
```

---

## 🧪 CLI Inspection Demo

You can inspect any simulated tool call directly from the terminal:

```bash
npx fast-mcp-gatekeeper --inspect '{"name": "read_file", "arguments": {"path": "/etc/passwd"}}'
```

**Output:**
```json
{
  "toolName": "read_file",
  "isMalicious": true,
  "maliciousProbability": 0.99,
  "threatLevel": "critical",
  "policy": "block",
  "reason": "BLOCKED: High-risk security policy violation detected in tool 'read_file'.",
  "latencyMs": 41
}
```

---

## 📄 License

MIT © Kartik Modi