Research preview · Updated October 23, 2026
MCPGuard technical brief
Architecture, verified controls and practical limits for a supported local MCP workflow.
MCPGuard is an experimental local stdio proxy. It allows explicit tool names, compares the observed tool catalog with an approved snapshot, and checks configured HTTPS-origin arguments. An opt-in adapter adds destination enforcement for a supported, isolated Chromium browser.
What has been tested
Local integration work used Codex CLI 0.163.0-alpha.10.2, Paper 0.5.16 and Playwright MCP 0.0.83 on macOS. The configured frontend protocol is 2025-06-18 and backend protocol is 2025-11-25. This does not certify other versions or platforms.
The October 20, 2026 regression suite passed 82 tests. Receiver-backed browser fixtures showed that HTTP 302/307 redirects, page-script fetch requests and image subresources could reach an off-list local receiver with argument checks alone. With the browser adapter enabled, those same cases recorded zero receiver hits; allowed navigation and same-origin fetches continued working.
After the host was restarted, a native chat test allowed example.com and blocked a page-initiated link to an off-list site with ERR_TUNNEL_CONNECTION_FAILED. The full redirect/script fixtures ran separately in a disposable clone of the saved configuration. They were not injected into that chat's browser.
How browser enforcement works
The adapter starts a per-backend loopback CONNECT proxy. Its allowed authorities come from the reviewed browser navigation origin rules. Off-list authorities are rejected before the proxy makes a DNS lookup or upstream TCP connection. The proxy does not decrypt TLS or log payloads. The guarded launch blocks service workers, disables QUIC and HTTP/2, and configures Chromium to disable non-proxied WebRTC UDP.
Connections, header size and timeouts are bounded. This browser-specific control does not impose an OS firewall on arbitrary MCP server processes.
What this does not establish
- Universal prompt-injection prevention, compliance or production certification.
- Isolation of arbitrary server code, other applications or same-user configuration edits.
- Containment of every browser protocol, DNS side channel or future browser version.
- That an unchanged tool implementation is honest, or that an allowed origin cannot forward data from its own server.
- Independent customer adoption, paid-pilot success or production false-positive rates.
Privacy and the website
Tool definitions, arguments and results exist in local proxy memory. Catalog approval files intentionally persist metadata. Payload logging is off by default; no external analysis service is required. Screenshots and other browser outputs are separate from proxy logs.
This landing page uses no analytics or third-party scripts. The pilot form opens your email client; it does not submit or store form entries on a server. Hosting providers may process normal request metadata. Do not include secrets, credentials or customer data in inquiries.
Evaluate a supported workflow
Contact the maintainer to obtain the evaluation build and agree the supported environment, reviewed origins, synthetic test cases, acceptance criteria and rollback. Initial pilots are scoped to staging. Price and support limits are agreed before kickoff.
Request an evaluation build ↗