# Introducing Ayeixa MCP Guardian: Capability Fencing & Parameter Sanitization for MCP

> Source: <https://dev.to/alp_allovi_45214d2d8316a1/introducing-ayeixa-mcp-guardian-capability-fencing-parameter-sanitization-for-mcp-14dj>
> Published: 2026-08-17 19:55:48+00:00

#
Introducing Ayeixa MCP Guardian: Capability Fencing & Parameter Sanitization for MCP

Model Context Protocol (MCP) empowers language models to interact directly with databases, filesystems, and CLI utilities. However, exposing tool APIs creates security vulnerabilities: unauthorized directory traversal (`../../etc/passwd`

), destructive shell commands (`rm -rf`

), and untracked actions.

**Ayeixa MCP Guardian** (`@ayeixa/mcp-guardian`

) is a runtime capability fence and parameter sanitization middleware for Model Context Protocol servers and client tool invocations.

##
1. Core Architecture

MCP Guardian operates as an interceptor middleware:

-
**ToolPermissionFence**: Enforces granular Role-Based Access Control (RBAC) and explicit tool allowlists/denylists.
-
**InvocationSanitizer**: Sanitizes parameter arguments, blocking directory traversal patterns (`../`

) and dangerous system commands (`sudo`

, `rm -rf`

, `chmod 777`

).
-
**RuntimeAuditLogger**: Records every invocation payload, argument set, and permission verdict into a tamper-evident SHA-256 cryptographic hash chain.
-
**GuardianSandbox**: Permission-gated execution wrapper evaluating authorization rules and logging audit records before dispatching to tool executors.

##
2. Implemented Capabilities & Test Verification

Verified with hermetic unit tests:

-
**Permission Fencing**: RBAC and denied command enforcement (`tests/permission.test.ts`

).
-
**Audit Ledger**: Cryptographic hash chain validation (`tests/audit.test.ts`

).
-
**Execution Wrapper**: Permission-gated dispatch and error containment (`tests/sandbox.test.ts`

).

Verification: **6/6 hermetic unit tests passing** (0 failures).

##
3. Local Quick Start

###
Usage Example

##
4. Limitations & Contributing

- Pre-release
`v0.1.0-alpha`

. Provides application-level permission gating and parameter sanitization.
- Public npm publication is pending.
- We encourage security developers and researchers to contribute. See open
`good first issue`

tags on GitHub.

License: Apache-2.0