Mastyf.ai

What mastyf-ai/mastyf.ai MCP server does

The mastyf-ai/mastyf.ai MCP server places a security proxy between AI clients and the MCP tools they invoke. It receives tool calls, evaluates their arguments and structure, applies configured rules, and forwards only requests that pass enforcement. Failed checks stop the tool call before it reaches the underlying infrastructure, while decisions and request details are recorded for review.

The README describes protections for prompt injection, sensitive-path access, secret exfiltration, shell commands, unauthorized data transfers, SSRF targets, encoding-based evasion, runaway usage, and tool-definition changes during a session. The architecture lists Cursor, Claude Desktop, and Cline as example AI clients, with filesystem tools, GitHub, databases, and APIs among the protected destinations.

How it works

Each request moves through three enforcement stages. Pattern detection scans for suspicious strings such as injection attempts, dangerous paths, credentials, shell syntax, and encoded content. Schema validation then rejects malformed JSON-RPC messages, invalid payloads, and arguments that exceed configured size limits. A semantic review stage can inspect borderline requests with Ollama or another configured cloud model; without a model, the proxy falls back to heuristics.

Policies are stored in YAML and can define the operating mode, default action, argument patterns, and call-rate limits. The supported modes are audit, warn, and block. Audit records activity without stopping calls, warn records and flags requests while forwarding them, and block prevents policy violations from executing. Policy changes can be hot-reloaded through the dashboard.

Setup and configuration

The documented build path for the mastyf-ai/mastyf.ai MCP server starts from a Linux checkout. It requires Git, and the supplied setup script installs Nix when necessary, enables flakes, creates the development environment, installs dependencies, rebuilds native packages, and builds the project. After setup, start the local proxy and dashboard with node dist/cli.js start; the documented dashboard address is http://localhost:4000.

The HTTP bridge can be checked by sending a JSON-RPC tools/list request to /mcp. A default local development configuration disables dashboard authentication, so the README warns against exposing port 4000 publicly unless dashboard authentication is enabled. Rules are maintained in default-policy.yaml, and templates for HIPAA, PCI-DSS, GxP, and data residency are provided in policy-templates/.

Tools and capabilities

The local dashboard provides several operational views:

• Protection metrics, triggered rules, and a live threat feed
• Activity records with tool arguments, outcomes, and timestamps
• A policy editor with YAML hot reload
• A threat-testing area for reviewing proposed attack tests
• Per-call token usage and cost estimates

The repository also describes coordinated CI and runtime security processes. CI checks include source, dependency, and configuration scanning, adversarial fixtures, evasion probes, Node/Python parity checks, and live stdio MCP tests. Runtime components maintain block statistics, support optional semantic auditing, generate rule suggestions, and calibrate labels and thresholds.

Limitations and notes

The material does not identify a required credential or paid API key for the local proxy. Semantic review is optional, but using a cloud model may introduce separate model-provider requirements. Dashboard authentication is not enabled in the default local development configuration. The README also describes a Python SDK and Docker image in the project description, but the documented quick start here uses the locally built Node CLI.