Code Firewall MCP

What code-firewall-mcp MCP server does

code-firewall-mcp MCP server acts as a pre-execution filter for code supplied by an agent workflow. It accepts either a file path or an inline code string and returns a safety decision with fields such as whether the code was allowed or blocked and its similarity score.

The filter is based on code structure rather than exact text. During normalization, identifiers and literals are generally removed so variations of the same operation can be compared. Security-sensitive names, including terms associated with evaluation, shell access, and subprocess execution, remain available to help distinguish risky structures.

The project is intended for workflows that pass generated or user-provided code to execution tools. The README specifically describes using it before rlm_exec, and it can also be enabled through the firewall integration for massive-context-mcp.

How it works

The processing pipeline parses code into a concrete syntax tree when tree-sitter parsing is available, creates a normalized structural representation, and sends that representation to Ollama for embedding. ChromaDB stores the blacklist and supports similarity comparisons against known patterns.

A similarity result at or above the configured block threshold is treated as blocked; a lower result is allowed. Near-miss examples can be recorded separately to help refine the classifier boundary. The default block threshold is 0.85, while the default near-miss threshold is 0.70.

Because the decision uses similarity rather than a fixed list of literal strings, changing command arguments does not necessarily avoid a match. The system still depends on its stored patterns, embedding model, thresholds, and parsing behavior, so it should be treated as a filter rather than a complete security analysis system.

Setup and configuration

Install the package with uvx code-firewall-mcp, install it with pip, or build it from source using the repository's uv workflow.

Ollama is required for embeddings, and the configured embedding model defaults to nomic-embed-text. The MCP configuration can set FIREWALL_DATA_DIR for local data and OLLAMA_URL for the Ollama endpoint. The server defaults to a local Ollama service at http://localhost:11434.

On macOS with Apple Silicon, setup tools can check system requirements and install Ollama either through Homebrew or a direct download. Both setup paths can start the service and pull the embedding model. firewall_ollama_status verifies whether Ollama and the embeddings are available.

Tools and capabilities

The server exposes tools for two main areas:

• firewall_check evaluates a code file.
• firewall_check_code evaluates an inline code string.
• firewall_blacklist adds a dangerous pattern with a reason and severity.
• firewall_record_delta stores a near-miss variant and related notes.
• firewall_list_patterns lists blacklist or delta entries.
• firewall_remove_pattern deletes entries from those collections.
• firewall_status reports firewall status and statistics.
• firewall_system_check, firewall_setup_ollama, firewall_setup_ollama_direct, and firewall_ollama_status support environment setup and diagnostics.

A typical flow checks code first, stops when the result is blocked, and forwards only allowed code to an execution tool. With the documented massive-context-mcp firewall integration enabled, rlm_exec performs that check automatically.

Limitations and notes

The documented automatic setup targets macOS and Apple Silicon. Ollama, ChromaDB, and an embedding model are part of the runtime requirements, while tree-sitter is optional for improved parsing. Storage location, Ollama endpoint, model, and thresholds are configurable through environment variables. The project is released under the MIT license.