blastradius-mcp

BlastRadius MCP is a zero-trust security proxy for Model Context Protocol (MCP) servers. The problem it solves is this: granting agents access to bash, filesystems, SQL, or the cloud through MCP is equivalent to giving a language model the ability to execute rm -rf, DROP TABLE, or aws s3 rb; at the same time, tool inputs and outputs often carry unmasked AWS keys, GitHub PATs, and database passwords, and there is no mechanism to simulate the consequences before a call lands, nor any record afterward for review.

Core capabilities and how it works

• Pre-execution parsing and scoring: The engine first reconstructs the command according to POSIX shell parsing, then runs rule matching against the reconstructed command and produces a score from 0-100, blocking dangerous calls. The parsing steps include quote removal, variable assignment tracking, parameter expansion, command substitution, pipeline splitting, inline program extraction, and interpreter detection. The report includes a parsing block so reviewers can see the text that was actually matched.
• DLP credential masking: Bidirectionally scans for credentials and PII, including AWS access keys, GitHub PATs, OpenAI, Stripe keys, Slack tokens, SSH private keys, database URI passwords, JWTs, credit card numbers, US SSNs, and email addresses.
• Policy gate and approval tokens: Built-in four-rule policy, which can be overridden with custom JSON via --policy. High-impact operations require HMAC-SHA256-signed, JWT-shaped approval tokens, with a default 300-second TTL, up to one hour, single-use, and replay protection.
• Sequence detection: After per-call adjudication, detects five workflow patterns based on the hash-chained decision log, can only tighten and not loosen decisions, each signal references the index of the entry that triggered it, and returns truncated: true when the analysis window is truncated.
• Audit log: Append-only JSONL, SHA-256 hash chain, one HMAC-SHA256 signature per entry. Payloads are hashed but not stored, so secrets do not fall into the log. verify_audit_log recomputes all hashes and signatures; any field that is edited will break verification and report the index.

Installation and usage Requires Node 22+. It can run as a standalone MCP server and be called by agents; it can also wrap existing servers, with no downstream changes needed. In examples/ there are usableConfiguration, and can be installed as a local MCP package with one click via manifest.json. The proxy accepts an upgrade approval token through the confirmationToken parameter at call time; this parameter is stripped before forwarding and does not reach the downstream server. The signing key must be set explicitly, otherwise previously stored entries cannot be verified after a restart; the ledger defaults to process.cwd(), and specifying an explicit path is recommended.

Use cases

• Provide coding agents with secure shell, filesystem, SQL, or cloud access
• MCP deployments that require pre-execution risk assessment, credential redaction, human approval, and auditable logs

Limitations

• Does not decode Base64, hexadecimal, or ROT-encoded payloads
• Single-call analysis cannot cover multi-hop indirect references (such as a script written earlier) or destructive payloads assembled character by character
• Non-shell MCP tool parameters are only scored and do not pass through the parser
• Sequence detection has blind spots such as sub-window attacks, cross-caller laundering, slow leakage, and destructive classification reconstruction
• The audit chain does not detect entry deletion, truncation, or rewriting, and has no external or Merkle anchoring; it is tamper-evident rather than fully tamper-proof
• requestedBy is free text provided by the calling agent, with no out-of-band human channel or identity provider
• Downstream commands are split by whitespace, so paths containing spaces will cause problems; the proxy is a line-oriented JSON-RPC pass-through, not a full MCP SDK client
• The proxy exposes the downstream server's tools, not BlastRadius's own six tools

Technical information 24 signing rules and 11 DLP detectors. Risk bands: SAFE <15, LOW 15-39, MEDIUM 40-69, HIGH 70-89, CRITICAL 90+. 145 tests across nine files, CI runs on Node 22 and 24, CodeQL covers javascript-typescript. Built with tsc using strict: true, with no bundler, framework, or test runner dependencies. Licensed under Apache-2.0, with only two runtime dependencies, runs locally, opens no sockets, exfiltrates no data, has no license key, and has no paid tier.