Seatbelt MCP server

MCP Seatbelt — Runtime Guardrails for AI Agent Tools

Block dangerous MCP tool calls at the protocol layer. Scan, proxy, enforce.

Part of the MCP Security Platform. Scan before you trust with mcp-observatory (236★), then enforce at runtime with mcp-seatbelt. 📄 Read the technical whitepaper.

🌐 Website: kryptosai.github.io/mcp-seatbelt — demo, comparison, pricing

<!-- -->

The Problem

AI coding agents (Cursor, Claude, VS Code, ChatGPT, Windsurf, and others) connect to MCP servers that expose file systems, shell interpreters, network access, and environment variables. Static scanners tell you you're exposed — but they act after the fact. By the time a scanner flags a risky server, the agent may have already run a destructive command, exfiltrated credentials, or reached out to an untrusted endpoint.

MCP Seatbelt adds a runtime enforcement layer. It acts as a policy proxy between the agent and every MCP server, evaluating each JSON-RPC tool call against rules you control and denying dangerous requests before they reach the upstream. It does not operate at the TCP level — it inspects and gate-checks every call at L7 (the MCP protocol layer) before forwarding.

What It Does

Detection & Proxy

• Detects MCP configs across 8 clients — Automatically discovers MCP server configurations from Cursor, Claude Desktop, VS Code (user + workspace), ChatGPT Desktop, Codex, JetBrains IDEs (IntelliJ, PyCharm, WebStorm, etc.), Windsurf, and project-local files (.mcp.json, .mcp/config.json). No manual wiring required.

• Runtime proxy with policy enforcement — Starts a transparent JSON-RPC 2.0 proxy on port 9420. Every tool call, resource access, and prompt request is intercepted, evaluated against your policy, and allowed, denied, warned, or redacted. Three modes: default-deny (zero-trust), allowlist (whitelist known-good), and audit (log only, no blocking).

• 13 built-in risk rules — Covers shell interpreters (bash, sh, zsh, python, node), sandbox bypass (--no-sandbox, --disable-web-security), credential exposure in environment variables, Docker privileged containers, raw network tools (curl, nc, telnet), process spawning, destructive filesystem operations, remote URL access, risky package runners (npx, uvx), privilege escalation (sudo, chmod), and sensitive filesystem paths.

Shortened. The full README is on GitHub.