MCP Bastion

Name: MCP Bastion
Author: Gowthaman90

by Gowthaman90version 1.5.0i★ 7iRuns on your computer

Registry nameio.github.Gowthaman90/mcp-bastion

Install

Overview

Description from the maker (original English)

Reliability + security proxy for MCP: runtime tool-security and a compliance-mapped audit trail.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi2 of 2 passedChecked from public information; code not scanned yet
UsageiEarly↓ 466/wk · ★ 7

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Law & government data

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 2 of 2 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "bastion": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-bastion"
      ]
    }
  }
}

Run this in your terminal

claude mcp add bastion -- npx -y mcp-bastion

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "bastion": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-bastion"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "bastion": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "mcp-bastion"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 10, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account Gowthaman90, which owns the repo
✓ Pass
Still maintained
Code last changed yesterday
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Law & government datai

More stars than 97% of the other 1790 servers in this category
Published to the registry more recently than 87% of the other 1790 servers in this category
Basic checks equal to or better than 100% of the other 1790 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is MCP Bastion safe?

It passed 2 of 2 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed yesterday, and the latest version (1.5.0) reached the registry 6 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Korean Law MCP, Tw Legal Rag, Parse-DMARC MCP Server

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Korean Law MCP

Korean law: statutes, precedents, ordinances, treaties and citation verification (법제처 API).

by chrisryugjWidely used★ 2.9KUpdated 7 days ago

Runs in the cloud

Install

Tw Legal Rag

Taiwan law MCP server: 22M court judgments, statutes, agency rulings, with citation checks

by aa0101181514Growing★ 345Updated 4 days ago

Runs in the cloud

Install

Parse-DMARC MCP Server

Lightweight DMARC parser: auto-fetch email reports, visualize compliance in a single all-in-one app

by meysam81Growing★ 231Updated 9 months ago

Runs on your computer

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

🛡️ mcp-bastion

A reliability & security proxy for the Model Context Protocol (MCP).

_Self-healing connections, runtime tool-security, and a compliance-mapped audit trail for your MCP servers._

-2ea44f-2ea44f))](https://github.com/Gowthaman90/mcp-defense-bench)

mcp-bastion sits between your MCP client (Claude Code, Cursor, Cline, Windsurf, Zed, Claude Desktop, or any MCP-compliant agent) and your MCP servers. It is client-agnostic — it works with any compliant client through configuration alone, with zero client-specific code — and non-invasive: your servers run unchanged, and removing Bastion is a one-line config revert.

📦 Package: mcp-bastion on npm · 🗂️ Official MCP Registry: io.github.Gowthaman90/mcp-bastion

🔒 Security, measured: on the open, vendor-neutral mcp-defense-bench v0.9.0, Bastion covers 66% of the MCP attack surface (24.6/37 vectors; 23 enforced) on development fixtures and 53% on the pre-registered held-out set, at zero false positives on matched controls — the broadest of the proxies measured.

📖 Launch story: Medium · dev.to

👤 Created & maintained by [Gowthaman Arumugam](https://github.com/Gowthaman90) — Independent Researcher. Companion benchmark: mcp-defense-bench.

Why
How it works
Security model
Features
Quick start
Demo
Control tools
Configuration
Transports
Per-user identity (gateway mode)
Delegation checks
Runtime authorization
Runtime security
Audit & compliance
Client setup
Architecture
Development
Roadmap
Contributing
Security
License

Why

When an MCP server disconnects mid-session, the agent only sees a generic _"No such tool available"_ error — indistinguishable from a tool that never existed — and it cannot reconnect; only a human can. Long agent sessions silently lose capabilities and fail in confusing ways.

Bastion closes that gap. It health-checks every server, auto-reconnects with backoff, and — crucially — exposes control tools so the agent itself can inspect connection health and recover a dropped server without human intervention.

Bastion now spans three layers: reliability (v0.1), runtime security (v0.2 — tool pinning /

rug-pull & poisoning detection), and audit & compliance (v0.3 — pluggable sinks mapped to NIST

AI RMF / OWASP LLM Top 10). See the roadmap.

How it works

Today your client connects directly to each server. With Bastion, your client connects to Bastion, which connects to those same servers on your behalf — so it sits in the tool-call path and can add reliability (and, later, security) transparently.

Before:   Client ─▶ server A / server B / server C

After: Client ─▶ mcp-bastion ─▶ server A ─▶ server B ─▶ server C

Bastion is a standard MCP server to your client and a standard MCP client to each upstream. Because it speaks the protocol faithfully, it works with every compliant client automatically — the only per-client difference is where you put a few lines of config.

Security model

Bastion's security rests on three independent mechanisms. Heuristics feed all three and replace none of them: a heuristic finding is a risk signal, never a proof that a tool is safe.

Mechanism	What it gives you	Checks
Definition integrity	The tool, server and configuration you approved are the ones being called	tool pinning (rug pull), server identity, config drift, argument schema
Runtime authorization	Each caller reaches only the tools and argument values its policy grants, decided before any upstream contact	`authorization` rules, delegation checks (who acts for whom), MRTR continuation custody
Trustworthy audit evidence	Every decision is recorded without leaking secrets, and a changed or shortened log can be detected	audit events, hash chain, signed checkpoints, sink health, redaction

Every finding carries a kind: deterministic (an exact comparison against a pin, a schema, a policy or a token's claims) or heuristic (pattern matching that can misfire on benign text and can be evaded by a novel payload). What each enforcement profile does with them:

Check	Kind	`observe`	`balanced` (default)	`strict`
Tool pinning (rug pull), server identity	deterministic	warn	block	block
Runtime authorization	deterministic	warn	block	block
Delegation token checks	deterministic	warn	block	block
Delegation chain depth / cycles	deterministic	warn	warn	block
Cross-server data flow	deterministic	warn	block	block
Argument inspection: schema, plus command-injection and injected-instruction patterns	mixed	warn	block	block
MRTR (`input_required`) gate	mixed	warn	block	block
Description poisoning	heuristic	warn	warn	block
Response heuristics (injection, steering)	heuristic	warn	warn	block

Argument inspection blocks under balanced even though part of it is heuristic: a false positive costs the agent a retry, while a miss can run a command. Inline secret redaction in results (redactResponseSecrets) is on in every profile. Under observe nothing is blocked and each audit event records wouldBlock: what balanced would have done.

Known limits. Poisoning and response heuristics can be evaded by payloads they have not seen. Redaction covers known secret shapes, not every secret. Bastion does not sandbox the upstream server itself. Authorization trusts the identities it is given: bearer clients it authenticates itself, and delegation claims it verifies only in signature mode (see trustStructuralClaims).

Features

🔌 Client-agnostic — one binary, config-only integration; no per-client plugins.
♻️ Self-healing — health checks + capped exponential-backoff auto-reconnect for stdio servers.
🧭 Agent-recoverable — bastion__status and bastion__reconnect let the agent detect and fix drops itself, instead of hitting an opaque "no such tool" wall.
🧩 Transparent aggregation — merges many servers into one, with per-server tool namespacing to prevent collisions and tool-shadowing.
💬 Legible failures — a dropped server yields an actionable message, not a crash.
🛡️ Runtime security _(new in v0.2)_ — pins each tool's definition and blocks "rug pulls" (a server changing a tool after approval); heuristically inspects descriptions for poisoning; detects cross-server shadowing. See Runtime security.
🔐 Runtime authorization _(new in v1.4, opt-in)_ — per-caller, per-tool policy decided before any upstream contact: which client, user and agent may call which tool with which argument values, deny-overrides, default-deny, and an observe mode to preview a policy. See Runtime authorization.
📝 Audit & compliance _(opt-in)_ — structured, hash-chained audit events to pluggable sinks (console / file / webhook / OTLP), mapped to NIST AI RMF & OWASP LLM Top 10; since v1.4 with HTTPS-only remote sinks, retrying delivery, per-sink redaction and Ed25519-signed checkpoints that make a shortened log detectable. See Audit & compliance.
🪶 Non-invasive & reversible — your servers run unchanged; uninstall is a config revert.
🧱 Enterprise-grade codebase — strict TypeScript, layered architecture, ESLint + Prettier, and unit + end-to-end tests.

Quick start

Bastion is published on npm as mcp-bastion — the npx command below fetches it automatically, so there's nothing to install first.

1. Add Bastion to your client, pointing it at a config file:

// your client's mcpServers config

{ "mcpSer

Only the beginning is shown; read the rest in the repo

MCP Bastion

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Law & government datai

Common questions

Alternatives

Korean Law MCP

Tw Legal Rag

Parse-DMARC MCP Server

README from the maker

🛡️ mcp-bastion

Contents

Why

How it works

Security model

Features

Quick start