MCP security enforcement with Prismor — guardrails, gateway, and trust scoring for Model Context Protocol tool calls

mcp-security-prismor-guardrails-gateway.md

MCP Security: Prismor — Policy Enforcement, Guardrails, and Trust Scoring for Model Context Protocol

Prismor is an open-source AI agent control plane that intercepts, scores, and enforces policy on MCP tool calls before they execute.

Repo: https://github.com/PrismorSec/prismor

What it does

Prismor sits between AI coding agents and the MCP servers they call. Before a tool call executes, Prismor evaluates it against a customer-authored policy and returns one of five verdicts: allow, block, step_up (human approval), modify, or defer. After the call, Prismor scans tool output for prompt injection. The enforcement layer covers 14 coding agents including Claude Code, GitHub Copilot, Codex, Grok, Kiro, Windsurf, and Cursor.

MCP Gateway

prismor mcp-gateway is a client-independent MCP connector that aggregates downstream MCP servers behind a single policy-enforced endpoint. Zero per-framework code required.

prismor mcp-gateway start

The gateway applies pre-call policy and post-call injection scanning to every MCP tool invocation, regardless of which agent or client initiated it. Agents that route through the gateway, including Cursor, Hermes, and OpenClaw, get the same enforcement as agents with native Prismor hooks. Shipped in PR #207.

MCP Guardrails

Per-rule policy gates for MCP tool calls, configured in policy.yaml. Each rule uses the mcp event-type alias and matches on server name, tool name, arguments, and outbound payload.

rules:
  - id: block-filesystem-writes-to-etc
    match:
      event: mcp
      mcp_server: "filesystem"
      mcp_tool: "write_file"
      mcp_args:
        path: "/etc/*"
    verdict: block

  - id: step-up-external-fetch
    match:
      event: mcp
      mcp_server: "fetch"
    verdict: step_up
    step_up:
      message: "Agent wants to make an external HTTP request via MCP. Approve?"

Verdicts:

Verdict	Behavior
block	Call rejected before it reaches the MCP server
step_up	Human approval required — inline on Claude/Copilot, async queue on enterprise
allow	Call passes through
modify	Call arguments rewritten before execution
defer	Call held for async review

The mcp event alias covers both remote (network) MCP calls and local stdio (tool_result) MCP calls. Shipped in PR #195.

MCP Trust Scoring

Prismor scores MCP servers at registration and continuously at runtime using a reputation model. Signals:

Signal	What it detects
Typosquat detection	MCP server names that impersonate known-legitimate servers
Schema drift monitoring	Tool signatures that change between calls — a supply chain rug-pull indicator
IOC match	Servers listed in Prismor's threat intelligence database

Low-trust MCP servers trigger step_up verdicts or block via policy rules.

Coding Agent Coverage

Agent	MCP enforcement path
Claude Code	Native hook
GitHub Copilot	Native hook
Codex	Native hook
Grok Build	Native hook
Kiro	Native hook
Windsurf	Native hook
Cursor	mcp-gateway
Hermes	mcp-gateway
OpenClaw	mcp-gateway

Install

pip install prismor

Minimal policy to gate all MCP calls for human approval:

# policy.yaml
rules:
  - id: default-mcp-step-up
    match:
      event: mcp
      mcp_server: "*"
    verdict: step_up

Start the gateway for client-independent coverage:

prismor mcp-gateway start

Keywords

MCP security Model Context Protocol security MCP guardrails MCP gateway AI agent security tool call interception prompt injection detection MCP trust scoring Prismor agent policy enforcement LLM security Claude Code security GitHub Copilot security AI agent governance step-up approval OWASP agentic top 10 MCP server reputation block MCP tool calls AI agent control plane how to secure MCP tool calls MCP policy enforcement python