Connecting local or cloud LLMs directly to databases, filesystems, and internal APIs via Model Context Protocol (MCP) creates a massive attack surface. If a model gets tricked by prompt injection or leaks credentials in context, there's rarely a safety boundary in place to catch it.
I spent the last few weeks building Krypton MCP, a high-throughput security proxy written in Go that acts as an interceptor between LLM clients and MCP servers.
Most MCP setups trust the LLM implicitly. Once the model decides to call a tool, the payload goes straight to execution. Krypton sits in the middle as a zero-trust proxy to inspect, sanitize, and log everything in real time.
Written in Go with minimal overhead to ensure sub-millisecond proxy latency on local tool-calling loops. Handles SSE transport, JSON-RPC framing, and process-level downstream proxying natively.
Curious how others here are handling security boundaries when giving local agents execution access to local tooling. PRs, benchmark feedback, and security edge cases are all welcome.
I decided to open-source this to get feedback on the security approach for local MCP setups and see what edge cases I might have missed. Would love to hear how others are handling agent safety.