Log inSubmit server
MCP Bastion logo

MCP Bastion

Routes MCP clients through a proxy that reconnects servers, enforces runtime security, and records compliance-mapped audit events.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Bastion

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "mcp-bastion": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-bastion"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

mcp-bastion places a standard MCP server between an MCP client and its upstream servers, adding health checks, automatic reconnection, runtime security controls, and audit logging. It exposes control tools that let an agent inspect connection health and recover a disconnected server. Reach for it when long-running agent sessions need connection recovery, tool-definition protection, authorization, or traceable security decisions without changing the upstream servers.

Use cases

  • Recover disconnected MCP servers during long-running agent sessions
  • Place runtime authorization between agents and upstream MCP tools
  • Detect tool-definition changes and configuration drift
  • Record redacted audit events for security and compliance review

Key features

  • Health checks and backoff-based reconnection
  • Tool pinning and server-identity checks
  • Runtime authorization and delegation validation
  • Argument, response, and cross-server data-flow inspection
  • Hash-chained audit events with signed checkpoints
  • Observe, balanced, and strict enforcement profiles

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

12/12 checks healthy over the last 90d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 1d ago via OSV.dev · mcp-bastion (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars7Stargazers on the source repository.
npm downloads1.3kPackage downloads in the last 30 days.
Last commit4d agoMost recent push to the default branch.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How MCP Bastion works

What mcp-bastion does

mcp-bastion is a reliability and security proxy for MCP deployments. An MCP client connects to Bastion instead of connecting directly to each upstream server, while Bastion connects to those servers as an MCP client. The upstream servers can continue running unchanged, and removing the proxy requires reverting the client configuration.

Its reliability layer monitors server health, reconnects dropped connections with backoff, and exposes control tools for inspecting connection state and recovering an unavailable server. This addresses sessions where a disconnected server otherwise appears to the agent as though its tools never existed.

Security controls cover tool-definition integrity, runtime authorization, delegation checks, cross-server data flow, argument inspection, and response handling. Audit events can be sent to pluggable sinks and mapped to NIST AI RMF and OWASP LLM Top 10 categories.

How it works

The request path is:

  • MCP client to mcp-bastion
  • mcp-bastion to one or more upstream MCP servers

Because Bastion presents a standard MCP server interface to the client and a standard MCP client interface upstream, it is designed to work with compliant MCP clients through configuration rather than client-specific code.

Security decisions are made before an upstream request is sent. Definition-integrity checks compare calls against approved tools, server identity, configuration, and argument schemas. Runtime authorization determines which caller can use which tools and argument values. Delegation checks evaluate who is acting for whom, including delegation-token claims and continuation custody.

The proxy separates deterministic findings from heuristic signals. Deterministic checks include pinning, identity, authorization, and token claims. Heuristic checks include description poisoning and response patterns such as injection or steering, so their findings are treated as risk signals rather than proof of malicious behavior.

Setup and configuration

Install the mcp-bastion package from npm and configure an MCP client to launch or connect to Bastion in place of the upstream servers. The project requires Node.js 20 or newer. Client-specific code is not required; the README names Claude Code, Cursor, Cline, Windsurf, Zed, and Claude Desktop as compatible clients.

Bastion is intended to be non-invasive: existing upstream servers remain unchanged, and disabling it consists of reverting the client configuration. The available enforcement profiles are observe, balanced, and strict, with balanced identified as the default.

Tools and capabilities

  • Health-check upstream MCP servers and reconnect them with backoff.
  • Provide control tools for connection inspection and server recovery.
  • Pin tool definitions and detect tool rug pulls, server-identity changes, and configuration drift.
  • Enforce runtime authorization, delegation checks, and cross-server data-flow rules.
  • Inspect schemas and arguments for command-injection or injected-instruction patterns.
  • Produce redacted, hash-chained audit evidence with signed checkpoints and sink-health tracking.

Limitations and notes

Security enforcement varies by profile. In observe, checks warn rather than block. balanced blocks deterministic integrity, authorization, delegation-token, cross-server-flow, and argument-inspection violations while warning on some delegation-chain and heuristic findings. strict also blocks delegation-chain violations, description-poisoning findings, and response heuristics.

Heuristic detections can produce false positives on benign text and can miss novel payloads. Argument inspection combines schema checks with pattern-based checks, so it also has this mixed behavior. Audit protection depends on the configured sink and includes mechanisms for detecting altered or shortened logs; inline response redaction is part of the security model.

The project reports benchmark coverage against the vendor-neutral mcp-defense-bench, including separate development-fixture and held-out results. Those measurements describe the tested benchmark scope rather than a guarantee against every MCP attack.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Bastion

mcp-bastion is an MCP server that connects MCP clients to upstream MCP servers through a reliability and security proxy. Its main tools expose connection health and recovery, while its controls cover tool pinning, runtime authorization, delegation checks, argument inspection, and compliance-mapped audit events for protected agent sessions.

Install the mcp-bastion package from npm and configure your MCP client to use Bastion instead of connecting directly to upstream servers. Node.js 20 or newer is required. The client configuration is the integration point, and the upstream MCP servers can remain unchanged.

Yes, mcp-bastion works with Cursor through MCP configuration. Cursor is one of the clients named as compatible, alongside Claude Code, Cline, Windsurf, Zed, and Claude Desktop. Bastion presents a standard MCP server interface and does not require client-specific code.

mcp-bastion health-checks upstream servers and automatically reconnects dropped connections with backoff. It also exposes control tools that allow the agent to inspect connection health and recover a server during a session.

mcp-bastion checks approved tool definitions, server identity, configuration, authorization rules, delegation claims, argument schemas, cross-server data flow, and injection patterns before upstream contact. Its observe, balanced, and strict profiles determine whether findings warn or block.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Bastion AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/mcp-bastion?style=directory)](https://allmcps.com/mcp/mcp-bastion)
HTML Embed
<a href="https://allmcps.com/mcp/mcp-bastion"><img src="https://allmcps.com/api/badge/mcp-bastion?style=directory" alt="MCP Bastion on AllMCPs" /></a>