🛡️ MCP-Shield Pro — Enterprise MCP Supply Chain & Runtime Governance Shield

Enterprise-grade zero-dependency security shield and runtime governance engine for Model Context Protocol (MCP) servers, AI agent tool pipelines, and AIBOM compliance.

⚡ Key Highlights & Core Capabilities

• ⚡ Zero External Runtime Dependencies: Pure Node.js ES Module runtime delivering sub-millisecond execution (< 2ms) with zero third-party npm package overhead.

• 🛡️ OWASP MCP Top 10 Security Audit: Automated static & dynamic code inspection covering unauthenticated endpoints, tool signature gaps, prompt injection, and command injection.

• 🔐 Cryptographic Tool Call Signing: HMAC-SHA256 tool request signing and replay attack prevention for agent execution pipelines.

• 📄 Standardized AIBOM Generator: Automated AI Bill of Materials (AIBOM) generation tracking component file hashes, tools, and security provenance.

• 🧱 Inline Runtime Parameter Firewall: Intercepts tool parameters in real-time to block path traversal, shell metacharacters, SSRF, and adversarial injection patterns.

• 🔌 Native MCP Protocol Server: Stdio JSON-RPC 2.0 interface exposing mcp_scan, generate_aibom, and mcp_verify tools directly to OpenClaw, Codex, Claude Code, and Cursor.

• 🎨 Interactive Browser Studio Dashboard: Embedded single-file studio (demo/index.html) featuring live security gauges, OWASP rule status, and parameter firewall sandbox.

• 🔄 Error-Resuming Auto-Installer: Executable ./install.sh with checkpoint tracking (.install_checkpoint) and ./install.sh --resume recovery.

Related MCP server: mcp_Shield

📐 System Architecture

🛡️ OWASP MCP Top 10 Security Rule Coverage

🚀 Quick Start & Installation

1️⃣ Automatic Installation with Error Resume

# Clone and run the self-healing auto-installer
git clone https://github.com/tonysheesh/mcp-shield-pro.git
cd mcp-shield-pro
./install.sh

# If any step is interrupted, resume automatically:
./install.sh --resume

2️⃣ Running Security Audits via CLI

# Run OWASP MCP Top 10 security audit on current codebase
node bin/mcp-shield.js --scan .

# Generate AI Bill of Materials (AIBOM)
node bin/mcp-shield.js --aibom .

# Run strict Quality Approval Gate checks
node bin/mcp-shield.js --quality .

⚡ Comparison & Superiority

💻 Programmatic API Usage

import { MCPScanner, ToolSigner, RuntimeFirewall, AIBOMGenerator } from 'mcp-shield-pro';

// 1. Audit an MCP tool file
const scanner = new MCPScanner();
const audit = scanner.scanFile('./lib/mcpServer.js');
console.log(`Security Score: ${audit.score}/100 | Passed: ${audit.passed}`);

// 2. Cryptographically sign a tool call
const signer = new ToolSigner('your-master-secret-key');
const signedPayload = signer.signToolCall('query_database', { query: 'SELECT 1' });

// 3. Verify signature
const verification = signer.verifyToolCall(signedPayload);
console.log(`Signature Valid: ${verification.valid}`);

// 4. Runtime parameter firewall inspection
const firewall = new RuntimeFirewall();
const inspection = firewall.inspectParams('read_file', { path: '../../etc/passwd' });
console.log(`Allowed: ${inspection.allowed}`); // false

🗺️ Roadmap

• Support for Ed25519 asymmetric public-key signature verification for decentralized tool execution.

• Real-time eBPF syscall filtering integration for containerized agent workloads.

• Automated OWASP MCP Top 10 rule auto-fixer (--fix) to patch vulnerabilities in-place.

• Multi-region threat intelligence feed synchronization for emerging prompt injection patterns.

• Browser Studio web assembly (WASM) compiler for client-side zero-server scanning.

📜 License

MIT License © 2026 tonysheesh