How Securie's mcp-guard crate validates every MCP tool dispatch

What it is

mcp-guard is `crates/mcp-guard/src/lib.rs` in the Securie repo. It implements the OWASP MCP Top 10 #1 (tool poisoning) defense + the rug-pull defense + the indirect prompt injection scope-bounding pattern. Three layers: TrustedCatalog (operator-authored TOML-signed allow-list, loaded once at boot), Validator (parses incoming McpManifest + checks invariants), ScopeGuard (per-dispatch O(1) check). All three layers must pass for a tool call to dispatch.

Vulnerable example

// inference-router invoking an MCP tool without ScopeGuard
let response = router
    .complete(&completion_request)
    .await?;
// No scope check. Whatever tools the model emits, the router dispatches.
// Tool poisoning, scope drift, rug-pulls all silently work.

Fixed example

// Same router, with mcp-guard wired in
let scope_guard = mcp_guard::ScopeGuard::from_catalog(catalog);
let router = router.with_mcp_guard(Arc::new(scope_guard));

let response = router
    .complete(&completion_request)
    .await?;
// Every tool dispatch passes through ScopeGuard::check().
// O(1) check (HashMap + bitflags). Reject = the call never reaches the MCP client.

How Securie catches it

// Same router, with mcp-guard wired in
let scope_guard = mcp_guard::ScopeGuard::from_catalog(catalog);
let router = router.with_mcp_guard(Arc::new(scope_guard));

let response = router
    .complete(&completion_request)
    .await?;
// Every tool dispatch passes through ScopeGuard::check().
// O(1) check (HashMap + bitflags). Reject = the call never reaches the MCP client.

Checklist

• Operator-authored TOML catalog committed to your repo (TrustedCatalog source)
• Catalog signed with operator key; mcp-guard validates the signature at boot
• Every MCP server entry: name + fingerprint + maxAllowedScope
• Inference-router constructed with `with_mcp_guard(scope_guard)`
• Per-dispatch failure surfaces as `AgentOutcome::SafetyBlocked` (not a recoverable observation)
• Operator runbook for catalog updates (rotate signing key + re-sign + redeploy)

FAQ

Related guides