Integration · Available
The MCP security proxy
It sits between an agent and its MCP servers and checks what the tools say, what the agent sends them, and what they return.
Status: Available. This integration is built and tested. Guardrino is delivered to pilot companies by HisnLabs, and some settings may still change before general release.
Developer reference · Install guide · AI platforms · Open model card · OpenAI-compatible proxy · Streaming · LiteLLM · Tutorial: OpenAI-compatible app · Tutorial: LiteLLM · Tutorial: MCP tools
Try it today Guardrino-t7 Open, an earlier version of our classifier, is public on Hugging Face under Apache-2.0. The demo runs in your browser: what you type stays on your device. Live demo · Model card · Same demo on Hugging Face
What it checks
| Moment | Check |
|---|---|
| Tools are listed | The tool descriptions are scanned, since an agent reads them as instructions. |
| A call goes out | The arguments are checked: canary token, personal data and URLs. |
| A result comes back | The result is scanned as context, in windows, so long outputs are read in full. |
A result is judged like any document the model reads as data. You can try the same check by hand through the inspect API with direction set to context.
POST /v1/inspect HTTP/1.1
Content-Type: application/json
{
"text": "<tool result text>",
"direction": "context",
"app": "support-agent",
"conversation_id": "conversation-7f3a"
}Transports
The proxy speaks MCP’s streamable HTTP transport (one route per server, /mcp/{name}) and, for local servers, stdio.
Configuration
List the MCP servers the proxy sits in front of. It stays off until servers is set, and each server gets its own route.
[mcp]
on_tool_poisoning = "drop" # "drop": remove a flagged tool from the list | "refuse": refuse the whole list
timeout_secs = 120
servers = [
{ name = "files", url = "https://mcp.example/mcp", headers = { Authorization = "Bearer UPSTREAM_TOKEN" } },
]Point your agent at the proxy instead of the MCP server.
{
"mcpServers": {
"files": { "url": "https://guardrino.example/mcp/files" }
}
}For a local stdio server, run guardrino-mcp-stdio --server-cmd "<command>" in place of the server in the agent’s configuration. It runs the command and checks every message in both directions the same way; no servers entry is needed.
{
"mcpServers": {
"files": { "command": "guardrino-mcp-stdio", "args": ["--server-cmd", "npx some-mcp-server"] }
}
}A refused call answers a JSON-RPC error (code -32000, data.code content_blocked). A flagged tool is removed from the list, or the whole list is refused, as on_tool_poisoning says. Not covered yet: requests and notifications that the server starts (such as sampling) are not inspected, and JSON-RPC batches are refused.