AegisGate MCP

🛡️ AegisGate MCP

Secure MCP server framework — 23 layers of defense, zero dependencies.

*A hardened, zero-dependency MCP server written in pure Go. Build your MCP server on a foundation that has security built in from line one — not bolted on after a breach.*

Apache 2.0 · 23 security layers · 79 regex patterns + CharCNN-BiLSTM (v15) ML detection · Zero CVEs · Zero external module dependencies

Found AegisGate MCP useful? [Star the repo](https://github.com/aegisgatesecurity/aegisgate-mcp) ⭐ and [tell a colleague](https://x.com/intent/tweet?text=Securing%20my%20MCP%20servers%20with%20AegisGate%20%E2%80%94%2023%20security%20layers%2C%20zero%20dependencies%2C%20ML%20threat%20detection%3A%20https%3A%2F%2Fgithub.com%2Faegisgatesecurity%2Faegisgate-mcp) — it helps other devs discover secure MCP tooling.

Quick Start · Security Layers · RBAC · Architecture · Protocol · Docs · Releases

AegisGate Security™ is a trademark of AegisGate Security, LLC, filed with the USPTO.

"AegisGate MCP" is an unregistered product name. See Trademark below.

---

Why AegisGate MCP?

38% of MCP servers have no authentication. 590+ security advisories. 3 critical CVEs in the official MCP SDKs in 6 months — including CVSS 9.8 remote code execution and the "Mother of All AI Supply Chains" flaw affecting 150M+ downloads.

The official MCP SDKs give you the protocol. They don't give you security. No authentication. No audit logging. No threat detection. No rate limiting. No RBAC. Every server built on a bare SDK starts with a blank security posture and it's on you to build it — or skip it, as 38% of servers do.

AegisGate MCP is the secure alternative. Build your MCP server on a foundation that has security built in from line one — not bolted on after a breach.

23 security layers. 79 regex patterns. Zero dependencies. Zero CVEs. Apache 2.0.

Need proxy mode, OAuth, SIEM, or compliance frameworks? See

When to Upgrade to AegisGate Platform

below — or explore [AegisGate Rampart](https://github.com/aegisgatesecurity/aegisgate-rampart)

for local AI API proxy protection.

---

Overview

AegisGate MCP is a hardened, zero-dependency MCP server written in pure Go. It sits between AI agents and the tools they call, applying 23 layers of defense to every request — from authentication and RBAC to neural threat detection and chain analysis.

Standard MCP servers assume a trusted local environment. In production — whether that's a cloud SaaS platform, an enterprise data pipeline, or an air-gapped plant network — agents may execute commands, query databases, or interact with critical systems. A single unauthorized or malicious tool call can cause data exfiltration, process disruption, or worse. AegisGate MCP wraps every tool call in defense-in-depth, all with zero external module dependencies so it can run air-gapped.

---

Quick Start

Build

go build -o mcp-server ./cmd/mcp-server

Run

# Basic TCP server on :8081

./mcp-server

With authentication and audit logging

./mcp-server --token my-secret --audit /var/log/mcp-audit.json

With demo tools (ping, system_info, echo)

./mcp-server --demo

stdio mode for local MCP clients (Claude Desktop, Cursor)

./mcp-server --transport stdio --demo

Streamable HTTP mode (MCP 2025-06-18)

./mcp-server --transport http --addr :8081 --demo

TLS + mutual TLS

./mcp-server --tls --tls-cert server.pem --tls-key server.key --tls-client-ca ca.pem

Config file + health endpoint

./mcp-server --config /etc/mcp/config.json --health-addr :8082

Docker

# Build and run (ML-enabled, ~127 MB, 0 CVEs)

docker build --target ml -t aegisgate-mcp . docker run -p 8081:8081 aegisgate-mcp --demo

With authentication and audit logging

docker run -p 8081:8081 \ -e MCP_AUTH_TOKEN=your-secret-token \ -e MCP_DEMO_TOOLS=true \ aegisgate-mcp

Distroless heuristic-only build (~10 MB, 0 CVEs, zero OS packages)

docker build --build-arg CGO_ENABLED=0 --target lite -t aegisgate-mcp:lite . docker run -p 8081:8081 aegisgate-mcp:lite --demo

The ML image uses debian:bookworm-slim with libgnutls30 purged (shared libraries and dpkg metadata removed), eliminating all 6 Trivy CVEs while keeping the glibc and ONNX Runtime dependencies required for neural inference. The lite image is true distroless (gcr.io/distroless/static-debian12:nonroot) — zero OS packages, zero CVEs, ~10 MB. Both targets include a built-in --health-check flag for Docker HEALTHCHECK (no wget/curl needed). Multi-arch builds support both linux/amd64 and linux/arm64.

ML Threat Detection (L3)

AegisGate MCP includes the same CharCNN-BiLSTM v15 neural model used by AegisGate Platform and Rampart — vendored with zero external module dependencies. The model provides:

• Semantic attack detection — catches prompt injection and jailbreak attempts that bypass regex pattern matching
• Evasion resistance — detects obfuscation techniques (leetspeak, Unicode homoglyphs, character transposition, vowel deletion, word reversal)
• Two-tier blocking — scores ≥0.95 block independently; scores 0.50–0.94 block only if L1 (regex) or L2 (input scanner) corroboration is present
• Shadow mode — log predictions without blocking (for calibration)
• Heuristic fallback — when CGO is unavailable, heuristic scoring provides baseline detection without ONNX

Library Usage

AegisGate MCP can be embedded as a Go library:

package main

import ( "context" "log" mcp "github.com/aegisgatesecurity/aegisgate-mcp" )

func main() { cfg := mcp.DefaultServerConfig() cfg.AuthToken = "my-secret-token" cfg.AuditLogPath = "/var/log/mcp-audit.json" cfg.RateLimitRPM = 120 cfg.ScanResponses = true

server, err := mcp.NewSecuredMCPServer(cfg) if err != nil { log.Fatal(err) }

// Register a custom tool // Note: tools are automatically scanned for prompt-injection poisoning // at registration time. If the description or inputSchema contains // malicious patterns, RegisterTool returns *ToolPoisoningError. server.RegisterTool("my_tool", "Does something useful", 40, map[string]interface{}{ "type": "object", "properties": map[string]interface{}{ "param1": map[string]interface{}{"type": "string"}, }, "required": []interface{}{"param1"}, }) server.RegisterToolHandler("my_tool", func(ctx context.Context, params map[string]interface{}) (interface{}, error) { return "result", nil })

// Register a resource (MCP resources/list, resources/read) server.RegisterResource("config://app/info", "App Info", "App config as JSON", "application/json", func(ctx context.Context, uri string) (*mcp.ResourceContent, error) { return &mcp.ResourceContent{URI: uri, Text: {"version":"1.0"}, MimeType: "application/json"}, nil })

// Register a prompt (MCP prompts/list, prompts/get) server.RegisterPrompt("code_review", "Generate a code review prompt", []mcp.PromptArgument{{Name: "filename", Required: true}}, func(ctx context.Context, args map[string]string) (*mcp.GetPromptResult, error) { return &mcp.GetPromptResult{ Messages: []mcp.PromptMessage{{Role: "user", Content: "Review " + args["filename"]}}, }, nil })

// Load built-in policy rules server.LoadDefaultPolicies()

// Start the server if err := server.Start(context.Background()); err != nil { log.Fatal(err) } defer server.Stop() }

See examples/simple-server/ for a complete working example that registers a tool, resource, and prompt.

ML Model Hot-Swap

Reload the neural threat detection model at runtime without restarting the server:

// Swap to a new ONNX model file (verifies SHA-256 hash)

err := server.ReloadMLModel("/path/to/new_model.onnx") if err != nil { log.Printf("model reload failed: %v", err) }

Tool Poisoning Detection

All tools registered via RegisterTool() are automati