Bulwark

Name: Bulwark
Author: bpolania

by bpolaniaversion 0.2.0i★ –iRuns on your computer

Registry nameio.github.bpolania/bulwark

Install

Overview

Description from the maker (original English)

AI agent governance: content scanning, audit logs, policy evaluation, session management.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other
You need to fill in: BULWARK_SESSION_TOKEN

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: BULWARK_CONFIG, BULWARK_SESSION_TOKEN

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

DockerDocker installed

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "bulwark": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "BULWARK_CONFIG",
        "-e",
        "BULWARK_SESSION_TOKEN",
        "ghcr.io/bpolania/bulwark:v0.2.0",
        "mcp",
        "start"
      ],
      "env": {
        "BULWARK_CONFIG": "your-value",
        "BULWARK_SESSION_TOKEN": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add bulwark --env BULWARK_CONFIG=your-value --env BULWARK_SESSION_TOKEN=your-value -- docker run -i --rm -e BULWARK_CONFIG -e BULWARK_SESSION_TOKEN ghcr.io/bpolania/bulwark:v0.2.0 mcp start

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "bulwark": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "BULWARK_CONFIG",
        "-e",
        "BULWARK_SESSION_TOKEN",
        "ghcr.io/bpolania/bulwark:v0.2.0",
        "mcp",
        "start"
      ],
      "env": {
        "BULWARK_CONFIG": "your-value",
        "BULWARK_SESSION_TOKEN": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "bulwark": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "BULWARK_CONFIG",
        "-e",
        "BULWARK_SESSION_TOKEN",
        "ghcr.io/bpolania/bulwark:v0.2.0",
        "mcp",
        "start"
      ],
      "env": {
        "BULWARK_CONFIG": "your-value",
        "BULWARK_SESSION_TOKEN": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

BULWARK_CONFIG env
Path to bulwark.yaml configuration file
BULWARK_SESSION_TOKEN secret env
Session token for operator authentication (bwk_sess_...)

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 6, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account bpolania, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 32466 servers in this category
Published to the registry more recently than 3% of the other 32466 servers in this category
Basic checks equal to or better than 100% of the other 32466 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Bulwark safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: BULWARK_SESSION_TOKEN

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.2.0) reached the registry 8 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Docker on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, HotCodePush

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated yesterday

Install

HotCodePush

by hotcodepush-team

Manage over-the-air (OTA) updates for React Native, Expo, Capacitor and Cordova apps.

Runs in the cloudUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Bulwark

Open-source governance layer for AI agents.

Bulwark sits between AI agents and external tools, enforcing policies, managing credentials, inspecting content, and maintaining a complete audit trail. One policy governs all your agents — Claude Code, OpenClaw, Codex, or any MCP/HTTP client.

Why Bulwark?

AI agents are powerful but ungoverned. They can access any tool, leak any credential, and leave no audit trail. Bulwark fixes this:

Policy enforcement — YAML-based rules control which tools agents can use, with glob patterns, scope-based precedence, and hot-reload
Credential management — Agents never see real secrets. Bulwark injects credentials at the last mile, encrypted at rest with age
Content inspection — Scan requests and responses for secrets, PII, and prompt injection. Block or redact automatically
Audit logging — Every action recorded in a tamper-evident SQLite database with blake3 hash chains
Rate limiting — Token-bucket rate limits per session, operator, tool, or globally. Cost tracking with budget enforcement
MCP-native — Works as an MCP gateway or HTTP forward proxy. Governance metadata on every tool call response

Install

# Homebrew (macOS / Linux)

brew install bpolania/tap/bulwark

Docker

docker pull ghcr.io/bpolania/bulwark

From source

git clone https://github.com/bpolania/bulwark.git cd bulwark && cargo build --release

Quick Start: Govern Claude Code with GitHub

This walkthrough connects Claude Code to GitHub through Bulwark. Every tool call is policy-evaluated, audited, and credential-injected — in about 5 minutes.

Prerequisites: Claude Code installed, a GitHub personal access token, and Node.js/npm (for the GitHub MCP server).

1. Initialize and verify

bulwark init my-project && cd my-project

bulwark doctor

doctor runs 9 diagnostic checks. All should pass.

2. Store your GitHub token

bulwark cred add github-token --type bearer_token

Prompts for the token — hidden input, encrypted with age at rest

Configure the credential-to-tool binding in your bindings file so Bulwark knows to inject this token for GitHub tool calls.

3. Configure the upstream GitHub server

Edit bulwark.yaml:

mcp_gateway:

upstream_servers:

name: github command: "npx" args: ["-y", "@modelcontextprotocol/server-github"] env: GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_TOKEN}"

policy: policies_dir: "./policies" hot_reload: true

audit: enabled: true

inspect: enabled: true inspect_requests: true inspect_responses: true

Make sure GITHUB_TOKEN is set in your shell (export GITHUB_TOKEN=ghp_...).

4. Write a policy

cat > policies/base.yaml << 'EOF'

metadata: name: quickstart-policy scope: global

rules:

name: allow-reads description: "Allow all read operations" match: actions: ["read_*", "get_*", "list_*", "search_*"] verdict: allow priority: 10

name: allow-github-writes description: "Allow creating issues, comments, PRs" match: tools: ["github__*"] actions: ["create_*", "update_*"] verdict: allow priority: 10

name: block-destructive description: "Block all delete and force-push operations" match: actions: ["delete_*", "force_push_*"] verdict: deny priority: 20 message: "Destructive operations are blocked by policy"

name: default-deny match: {} verdict: deny priority: -100 message: "No policy explicitly allows this action"

EOF

bulwark policy validate

5. Create a session and connect Claude Code

# Create a session (--ttl is in seconds: 28800 = 8 hours)

bulwark session create --operator $(whoami) --agent-type claude-code --ttl 28800

→ Token: bwk_sess_7f3a...

export BULWARK_SESSION="bwk_sess_7f3a..." # paste your actual token

Register Bulwark as an MCP server in Claude Code

claude mcp add --transport stdio bulwark \ --env BULWARK_SESSION=$BULWARK_SESSION \ -- bulwark mcp start

6. Use Claude Code — now governed

Start Claude Code. GitHub tools appear namespaced as github__list_issues, github__create_issue, etc.

Try it:

"List the open issues in my repo"

Open a second terminal:

bulwark audit tail

22:01:03  github__list_issues   ✓ allow   3ms  (allow-reads)

Every call is logged with the verdict, matched rule, and timing. Now try something destructive:

"Delete issue #1"

22:02:01  github__delete_issue  ✗ deny    <1ms (block-destructive)

Blocked. Sub-millisecond — policy evaluation happens in memory. The agent gets a structured error explaining which rule denied it.

What just happened

Claude Code connected to Bulwark (not directly to GitHub). For every tool call, Bulwark validated the session, scanned for secrets/PII, evaluated the policy, injected the real GitHub token, scanned the response, and recorded a tamper-evident audit event. Same agent experience — full governance underneath.

Going Deeper

Content inspection — 13 built-in patterns scan for AWS keys, GitHub tokens, private keys, PII, and prompt injection. Redaction happens before content reaches the agent.

bulwark inspect rules

bulwark inspect scan --text "my key is [PopNx MCP ตัดค่าที่หน้าตาเหมือนกุญแจออก]"

Policy replay — Preview the impact of policy changes against real audit history before deploying:

bulwark policy test --dir ./new-policies/ --since 1h

Audit forensics — Reconstruct a session timeline and verify the hash chain:

bulwark session inspect <session-id>

bulwark audit verify bulwark audit export --since 24h --format json

HTTP proxy mode — For non-MCP agents, Bulwark runs as a forward proxy with TLS interception:

bulwark proxy start

bulwark ca export # trust the CA in your HTTP client

Architecture

┌─────────────┐     ┌──────────────────────────────────────────────┐     ┌──────────────┐

│ │ │ Bulwark │ │ │ │ AI Agent │────>│ Session > Inspect > Policy > Inject > Proxy │────>│ Upstream │ │ (Claude, │<────│ <── Audit <── Inspect <── Response <─────── │<────│ Tool/API │ │ Codex, │ │ │ │ │ │ custom) │ └──────────────────────────────────────────────┘ └──────────────┘ └─────────────┘

Integration Modes

Mode	Transport	Best For
MCP Gateway (stdio)	stdio/JSON-RPC	Claude Code, OpenClaw, any MCP client
MCP Gateway (HTTP)	Streamable HTTP	Remote agents, MCP registry, multi-agent
HTTP Proxy	HTTP/HTTPS	Codex, curl, any HTTP client

Example Policy

# policies/base.yaml

metadata: name: my-policy scope: global

rules:

name: allow-reads verdict: allow priority: 10 match: actions: ["read*", "get*", "list*"]

name: block-destructive-in-prod verdict: deny priority: 100 match: actions: ["delete*", "drop*"] conditions: environments: ["production"]

name: default-deny verdict: deny match: {}

See examples/policies/ for complete policy sets (startup, enterprise, development, multi-agent).

CLI

bulwark init <path>              # Scaffold a new project

bulwark proxy start # Start HTTP/HTTPS proxy bulwark mcp start # Start MCP gateway (stdio) bulwark mcp serve # Start MCP gateway (HTTP) bulwark doctor # Diagnose setup issues (9 checks) bulwark status # Health dashboard bulwark policy validate # Validate policy files bulwark policy test --dir # Test policies against audit log bulwark session create|list|revoke|inspect bulwark cred add|list|remove|test bulwark audit search|tail|stats|export|verify bulwark inspect scan|rules # Content inspection bulwark ca export|path # CA certificate management bulwark completions # Shell completions (bash/zsh/fish)

Documentation

Getting Started
Architecture Overview
Policy Reference
Configuration Reference
Credential Management
Audit System
Content Inspector
Rate Limiting
Threat Model
Agent Guides: Claude Code | Codex | OpenClaw

Development

git clone https://github.com/bpolania/bulwark.git

cd bulwark cargo build --workspace cargo test --workspace # 487 tests cargo clippy --workspace --all-targets -- -D warnings

Project Structure

crates/

cli/ # CLI binary and commands proxy/ # HTTP/HTTPS forward proxy with TLS MITM mcp/ # MCP governance gateway config/ # Configuration loading and types policy/ # YAML policy engine with hot-reload vault/ # Credential storage and session management audit/ # Tamper-evident audit logging inspect/ # Content inspection (secrets, PII, injection) ratelimit/ # Token-bucket rate limiter and cost tracker common/ # Shared types and error definitions

License

Apache 2.0. See LICENSE.

Bulwark

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

HotCodePush

README from the maker

Bulwark

Why Bulwark?

Install

Docker

From source

Quick Start: Govern Claude Code with GitHub

1. Initialize and verify

2. Store your GitHub token

Prompts for the token — hidden input, encrypted with age at rest

3. Configure the upstream GitHub server

4. Write a policy

5. Create a session and connect Claude Code

→ Token: bwk_sess_7f3a...

Register Bulwark as an MCP server in Claude Code

6. Use Claude Code — now governed

What just happened

Going Deeper

Architecture

Integration Modes

Example Policy

CLI

Documentation

Development

Project Structure

License