{"slug": "kevlar-mcp-firewall-for-llm-s", "title": "Kevlar = MCP Firewall for LLM's", "summary": "Ablation-Tool released Kevlar, an open-source proxy firewall for the Model Context Protocol (MCP) that sits between an LLM client and MCP servers to block tool-poisoning and prompt-injection attacks. Kevlar strips every tool `description` field to an empty string on `tools/list` responses, scans `tools/call` results against roughly 60 injection indicators sourced from published prompt-injection research, blocks outbound calls carrying credentials, and in strict mode locks the tool registry after the initial handshake so servers cannot inject new tools mid-session. The tool requires Python 3.10+ and runs on Linux and macOS only, with strict, lenient and audit modes whose reject thresholds are scores of 40, 80 and never-block respectively.", "body_md": "Kevlar is a proxy firewall for Model Context Protocol\n\n```\nLLM  [ KEVLAR ]  MCP\n```\n\nIt sits between (you) and (everyone else)\n\nMCP servers control their own tools.\n\nThose tools (good or bad) go into your LLM blindly, due to trust.\n\nAny MCP server can exploit this to redirect the model, pull credentials, or add any tools they want.\n\nThe MCP spec does not prevent any of this.\n\nYou do not control what an MCP server puts in its messages.\n\n## TL;DR\n\nKevlar sits between client and server and does four things:\n\n1. Strips all tool descriptions before they reach the LLM. No exceptions.\n2. Scans tool call responses for injection payloads and either redacts matched spans or blocks the response entirely.\n3. Blocks outbound calls carrying credentials in their arguments, even if the LLM has already been compromised.\n4. Locks the tool registry after the initial handshake so the server cannot inject new tools mid-session.\n\n## CDR on `tools/list`\n\nKevlar strips every `description` field to `\"\"` unconditionally on every `tools/list` response, before the message reaches the client. The LLM sees `name` and `inputSchema` only. `inputSchema` is rebuilt from an allowlist: prose fields like `description`, `title`, `examples`, and `$comment` are stripped there too, and `enum` values, property keys, `$ref` targets, and `type` values are validated against the MCP spec. Score 0 on this pass cannot be achieved by adding description text back, because description text is never forwarded regardless of score.\n\n## Analysis on `tools/call` responses\n\nTool call results cannot be stripped without breaking functionality. Kevlar scans them against ~60 indicators sourced from published prompt injection research. Responses scoring above the mode threshold are quarantined (matched spans replaced with `[KEVLAR:<ID>]` tokens) or rejected (replaced with an `isError` block). Unicode bypass attempts using characters that normalize to injection text under NFKC are detected before normalization and redacted after.\n\n## Egress DLP\n\nOutbound `tools/call` arguments are scanned before the call is forwarded to the server. If the LLM has already been compromised and is trying to exfiltrate credentials, the call is blocked at the proxy layer. The server never receives it. Runs in all three modes.\n\n## Tool registry lock (strict mode)\n\nAfter the initial `tools/list` handshake, the set of callable tool names is frozen. `notifications/tools/list_changed` from the server is dropped, not forwarded. Any call to a tool not in the CDR-sanitized set is blocked with a synthetic `isError` response regardless of call content.\n\n## Install\n\n```\ngit clone https://github.com/Ablation-Tool/kevlar.git\ncd kevlar\npip install .\n```\n\nRequires Python 3.10+. Linux and macOS only. Depends on `os.killpg` and `asyncio.connect_read_pipe`.\n\n## Quickstart\n\n```\nkevlar --mode strict -- npx -y @modelcontextprotocol/server-filesystem /tmp\nkevlar --mode audit --log /tmp/kevlar.jsonl -- uvx mcp-server-git\n```\n\n## Claude Desktop integration\n\nIn `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS):\n\n```\n{\n  \"mcpServers\": {\n    \"filesystem\": {\n      \"command\": \"kevlar\",\n      \"args\": [\n        \"--mode\", \"strict\",\n        \"--log\", \"/tmp/kevlar-filesystem.jsonl\",\n        \"--\",\n        \"npx\", \"-y\", \"@modelcontextprotocol/server-filesystem\",\n        \"/Users/you/Documents\"\n      ]\n    }\n  }\n}\n```\n\n## Modes\n\n| Mode | Reject threshold | Tool registry | `list_changed` | \n|---|---|---|---|\n| `strict` | score ≥ 40 | Locked at handshake | Dropped | \n| `lenient` | score ≥ 80 | Dynamic updates allowed | Forwarded | \n| `audit` | Never blocks | Dynamic | Forwarded | \n\nUse `strict` in production. Use `audit` to profile a new server before tightening the threshold. `--log` produces a JSONL file with every policy decision, indicator ID, score, and masked value snippet.\n\n## Architecture\n\nTwo files: `policy.py` is a pure CDR engine with no I/O, directly unit-testable. `kevlar.py` is the async stdio proxy. No runtime dependencies, stdlib only. `kevlar.py` spawns the server with `start_new_session=True` and kills the process group on shutdown, so `npx`/` uvx` child processes don't linger.\n\nSee [docs/architecture.md](https://github.com/Ablation-Tool/kevlar/blob/main/docs/architecture.md) for the full design: proxy lifecycle, CDR pipeline per message type, scoring arithmetic, indicator registries, and audit log format.\n\n## Tests\n\n```\npip install -e \".[dev]\"\npytest\n```\n\n149 tests. `tests/test_proxy.py` runs integration tests against real subprocess pairs. `tests/test_policy.py` covers the pure policy engine in unit tests.", "url": "https://wpnews.pro/news/kevlar-mcp-firewall-for-llm-s", "canonical_source": "https://github.com/Ablation-Tool/kevlar", "published_at": "2026-10-24 22:24:09+00:00", "updated_at": "2026-10-24 22:42:00.355829+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "agent-protocols", "ai-tools", "large-language-models"], "entities": ["Kevlar", "Ablation-Tool", "Model Context Protocol", "Claude Desktop", "Python 3.10"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/kevlar-mcp-firewall-for-llm-s", "markdown": "https://wpnews.pro/news/kevlar-mcp-firewall-for-llm-s.md", "text": "https://wpnews.pro/news/kevlar-mcp-firewall-for-llm-s.txt", "jsonld": "https://wpnews.pro/news/kevlar-mcp-firewall-for-llm-s.jsonld"}}