# mcp-bastion [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/Gowthaman90/mcp-bastion  
**GitHub Stars:** 7  
**npm Downloads (last month):** 1297  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcp-bastion

## Description
Reliability + security proxy for MCP: runtime tool-security and a compliance-mapped audit trail.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-bastion": {
    "command": "npx",
    "args": ["-y","mcp-bastion"]
  }
}
```

## Documentation

## What mcp-bastion does

mcp-bastion is a reliability and security proxy for MCP deployments. An MCP client connects to Bastion instead of connecting directly to each upstream server, while Bastion connects to those servers as an MCP client. The upstream servers can continue running unchanged, and removing the proxy requires reverting the client configuration.

Its reliability layer monitors server health, reconnects dropped connections with backoff, and exposes control tools for inspecting connection state and recovering an unavailable server. This addresses sessions where a disconnected server otherwise appears to the agent as though its tools never existed.

Security controls cover tool-definition integrity, runtime authorization, delegation checks, cross-server data flow, argument inspection, and response handling. Audit events can be sent to pluggable sinks and mapped to NIST AI RMF and OWASP LLM Top 10 categories.

## How it works

The request path is:

- MCP client to mcp-bastion
- mcp-bastion to one or more upstream MCP servers

Because Bastion presents a standard MCP server interface to the client and a standard MCP client interface upstream, it is designed to work with compliant MCP clients through configuration rather than client-specific code.

Security decisions are made before an upstream request is sent. Definition-integrity checks compare calls against approved tools, server identity, configuration, and argument schemas. Runtime authorization determines which caller can use which tools and argument values. Delegation checks evaluate who is acting for whom, including delegation-token claims and continuation custody.

The proxy separates deterministic findings from heuristic signals. Deterministic checks include pinning, identity, authorization, and token claims. Heuristic checks include description poisoning and response patterns such as injection or steering, so their findings are treated as risk signals rather than proof of malicious behavior.

## Setup and configuration

Install the `mcp-bastion` package from npm and configure an MCP client to launch or connect to Bastion in place of the upstream servers. The project requires Node.js 20 or newer. Client-specific code is not required; the README names Claude Code, Cursor, Cline, Windsurf, Zed, and Claude Desktop as compatible clients.

Bastion is intended to be non-invasive: existing upstream servers remain unchanged, and disabling it consists of reverting the client configuration. The available enforcement profiles are `observe`, `balanced`, and `strict`, with `balanced` identified as the default.

## Tools and capabilities

- Health-check upstream MCP servers and reconnect them with backoff.
- Provide control tools for connection inspection and server recovery.
- Pin tool definitions and detect tool rug pulls, server-identity changes, and configuration drift.
- Enforce runtime authorization, delegation checks, and cross-server data-flow rules.
- Inspect schemas and arguments for command-injection or injected-instruction patterns.
- Produce redacted, hash-chained audit evidence with signed checkpoints and sink-health tracking.

## Limitations and notes

Security enforcement varies by profile. In `observe`, checks warn rather than block. `balanced` blocks deterministic integrity, authorization, delegation-token, cross-server-flow, and argument-inspection violations while warning on some delegation-chain and heuristic findings. `strict` also blocks delegation-chain violations, description-poisoning findings, and response heuristics.

Heuristic detections can produce false positives on benign text and can miss novel payloads. Argument inspection combines schema checks with pattern-based checks, so it also has this mixed behavior. Audit protection depends on the configured sink and includes mechanisms for detecting altered or shortened logs; inline response redaction is part of the security model.

The project reports benchmark coverage against the vendor-neutral `mcp-defense-bench`, including separate development-fixture and held-out results. Those measurements describe the tested benchmark scope rather than a guarantee against every MCP attack.

_Full upstream README: https://allmcps.com/mcp/mcp-bastion/readme_