# code-firewall-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/egoughnour/code-firewall-mcp  
**GitHub Stars:** 0  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/code-firewall-mcp

## Description
Structural similarity-based code filter. Stops malicious code pattern reaching execution tools.

## Tools
Capabilities this server exposes over MCP:

- **firewall_system_check** — Check system requirements** — verify macOS, Apple Silicon, RAM
- **firewall_setup_ollama** — Install via Homebrew** — managed service, auto-updates
- **firewall_setup_ollama_direct** — Install via direct download** — no sudo, fully headless
- **firewall_ollama_status** — Check Ollama availability** — verify embeddings are ready
- **firewall_check** — Check if a code file is safe to execute
- **firewall_check_code** — Check code string directly (no file required)
- **firewall_blacklist** — Add a dangerous pattern to the blacklist
- **firewall_record_delta** — Record near-miss variants for classifier sharpening
- **firewall_list_patterns** — List patterns in blacklist or delta collection
- **firewall_remove_pattern** — Remove a pattern from blacklist or deltas
- **firewall_status** — Get firewall status and statistics

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "code-firewall-mcp": {
    "command": "uvx",
    "args": ["code-firewall-mcp"],
    "env": {
      "FIREWALL_DATA_DIR": "",
      "OLLAMA_URL": "",
      "EMBEDDING_MODEL": "",
      "SIMILARITY_THRESHOLD": "",
      "NEAR_MISS_THRESHOLD": ""
    }
  }
}
```

**Requires environment variables:** `FIREWALL_DATA_DIR`, `OLLAMA_URL`, `EMBEDDING_MODEL`, `SIMILARITY_THRESHOLD`, `NEAR_MISS_THRESHOLD` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What code-firewall-mcp MCP server does

code-firewall-mcp MCP server acts as a pre-execution filter for code supplied by an agent workflow. It accepts either a file path or an inline code string and returns a safety decision with fields such as whether the code was allowed or blocked and its similarity score.

The filter is based on code structure rather than exact text. During normalization, identifiers and literals are generally removed so variations of the same operation can be compared. Security-sensitive names, including terms associated with evaluation, shell access, and subprocess execution, remain available to help distinguish risky structures.

The project is intended for workflows that pass generated or user-provided code to execution tools. The README specifically describes using it before `rlm_exec`, and it can also be enabled through the firewall integration for `massive-context-mcp`.

## How it works

The processing pipeline parses code into a concrete syntax tree when tree-sitter parsing is available, creates a normalized structural representation, and sends that representation to Ollama for embedding. ChromaDB stores the blacklist and supports similarity comparisons against known patterns.

A similarity result at or above the configured block threshold is treated as blocked; a lower result is allowed. Near-miss examples can be recorded separately to help refine the classifier boundary. The default block threshold is `0.85`, while the default near-miss threshold is `0.70`.

Because the decision uses similarity rather than a fixed list of literal strings, changing command arguments does not necessarily avoid a match. The system still depends on its stored patterns, embedding model, thresholds, and parsing behavior, so it should be treated as a filter rather than a complete security analysis system.

## Setup and configuration

Install the package with `uvx code-firewall-mcp`, install it with pip, or build it from source using the repository's `uv` workflow.

Ollama is required for embeddings, and the configured embedding model defaults to `nomic-embed-text`. The MCP configuration can set `FIREWALL_DATA_DIR` for local data and `OLLAMA_URL` for the Ollama endpoint. The server defaults to a local Ollama service at `http://localhost:11434`.

On macOS with Apple Silicon, setup tools can check system requirements and install Ollama either through Homebrew or a direct download. Both setup paths can start the service and pull the embedding model. `firewall_ollama_status` verifies whether Ollama and the embeddings are available.

## Tools and capabilities

The server exposes tools for two main areas:

- `firewall_check` evaluates a code file.
- `firewall_check_code` evaluates an inline code string.
- `firewall_blacklist` adds a dangerous pattern with a reason and severity.
- `firewall_record_delta` stores a near-miss variant and related notes.
- `firewall_list_patterns` lists blacklist or delta entries.
- `firewall_remove_pattern` deletes entries from those collections.
- `firewall_status` reports firewall status and statistics.
- `firewall_system_check`, `firewall_setup_ollama`, `firewall_setup_ollama_direct`, and `firewall_ollama_status` support environment setup and diagnostics.

A typical flow checks code first, stops when the result is blocked, and forwards only allowed code to an execution tool. With the documented `massive-context-mcp` firewall integration enabled, `rlm_exec` performs that check automatically.

## Limitations and notes

The documented automatic setup targets macOS and Apple Silicon. Ollama, ChromaDB, and an embedding model are part of the runtime requirements, while tree-sitter is optional for improved parsing. Storage location, Ollama endpoint, model, and thresholds are configurable through environment variables. The project is released under the MIT license.

_Full upstream README: https://allmcps.com/mcp/code-firewall-mcp/readme_