MCPShield is a Rust runtime sandbox for Model Context Protocol servers. A drop-in wrapper that enforces capability allowlists, filters outbound traffic and seals every policy it enforces — aligned to the NSA May-2026 MCP guidance, in a single cargo add.
An MCP server hands a model real tools — a filesystem, a database, an outbound network. The spec says nothing about who's allowed to call what, what may leave the box, or how to prove what you enforced. That's the boundary MCPShield owns.
Prompt-injected tool calls
A poisoned document tells the model to read your secrets and POST them out.
Over-broad capabilities
A server scoped to one folder quietly reaches the whole filesystem.
Silent data exfiltration
Sensitive payloads leave over an unmonitored outbound connection.
No evidence trail
When audit asks what was enforced, you have logs — not proof.
Every call runs the same ordered pipeline at the runtime boundary — not bolted on after. Default deny, end to end.
Only the tools and resource URIs you approve ever reach the wrapped server. Everything else is denied by default.
Every outbound call clears the host filter, regex DLP and IOC corpus before it is allowed to leave the sandbox.
Tool-call events export as OpenTelemetry GenAI semconv v1.36+ spans — no custom agent, no sidecar.
Policies are cryptographically signed, so you can prove exactly which guardrails were enforced for every deployment.
The runtime is open source and yours to self-host. The cloud adds the cross-tenant threat-intel network and attestation you can't build alone.
Protect your MCP servers with your own rules and see your own data.
Stop defending alone — get the cross-tenant threat intelligence network.
Attestation, compliance evidence and identity for security-led procurement.
Compare every tier on the full pricing page.
Add the crates to your workspace, declare a capability allowlist and outbound filter, and wrap any stdio MCP server. No daemon, no sidecar — the sandbox runs in-process.
# Cargo.toml
[dependencies]
mcpshield-runtime = { git = "https://github.com/mcpshieldvow/mcpshield-runtime" }
mcpshield-policy = { git = "https://github.com/mcpshieldvow/mcpshield-runtime" }
mcpshield-telemetry = { git = "https://github.com/mcpshieldvow/mcpshield-runtime" }Join the early-access program for the hosted control plane, or pull the crates and self-host today. Both speak the same telemetry.