Enterprise ABAC Reverse Proxy and Policy Enforcement Point (PEP) for the Model Context Protocol
The Model Context Protocol (MCP) bridges the gap between AI Agents (like Cursor, Windsurf, or Claude) and your local/remote environment. But if a malicious server sends an injection payload, or a compromised agent tries to exfiltrate data, the system has no defense.
RMCP is a high-performance, fail-closed security gateway written in Rust that intercepts, parses, normalizes, and strictly filters all MCP traffic in both directions before it executes. It acts as the "NGINX for MCP," treating the AI Agent as untrusted and applying strict, deterministic security boundaries.
- Core Features & Defense Mechanisms
- Architecture & Transports
- Developer Experience (DevX)
- Agent Experience (AgentX)
- IDE Integrations
- Academic Provenance
RMCP uses the cedar-policy engine to evaluate all incoming JSON-RPC calls. Every request is mapped to a Principal (Agent), Action (Tool), and Resource (Arguments). If the Cedar policy evaluates to Deny (or if no rule matches), the payload is dropped immediately.
Unlike basic string-matching proxies, RMCP parses inbound and outbound payloads into a strict Rust AST, canonicalizing file paths and arguments. This prevents TOCTOU (Time-Of-Check to Time-Of-Use) and path traversal bypasses.
RMCP bidirectionally scans responses from MCP servers to prevent secrets from entering the agent's context. Passwords, AWS Keys, and PII are redacted and replaced with placeholders like [RMCP_REDACTED_SECRET] using high-speed Aho-Corasick automata.
If Cedar dictates that an action requires human approval (e.g. @requires_approval("true")), RMCP gracefully suspends the JSON-RPC request and synthesizes an MCP Elicitation request back to the client UI. High-stakes actions (e.g., dropping a database) execute only after explicit human consent.
If the Cedar policy file is missing, the signature tampered with, or the proxy crashes, RMCP defaults to DENY or EXIT(1). The floodgates are never left open. We mathematically verify this behavior using the BINEVAL framework in our CI/CD pipeline, ensuring no regressions.
RMCP acts as a unified proxy supporting both major MCP paradigms:
- STDIO (Local Desktop): RMCP intercepts
stdin/stdoutbetween desktop IDEs and child-process MCP servers. - Streamable HTTP (Remote Enterprise): An Axum-based
POST /mcpserver that upgrades to streaming, replacing legacy SSE.
Regardless of transport, all traffic routes through the same core firewall pipeline (process_payload).
Explain Like I'm 5 (CLI Commands):
rmcp install <path>- Injects the security guard into your AI's configuration file (like Cursor or Claude).rmcp keygen <path>- Creates cryptographic keys so nobody can tamper with your security rules.rmcp <mcp-command...>- Runs the actual connection through the security guard. (e.g.rmcp npx @modelcontextprotocol/server-postgres).
Download the pre-built binary from GitHub Releases or install via Cargo (cargo install --git https://github.com/darksolitaire9-hub/rmcp).
Point RMCP at your IDE's config file (e.g. Claude Desktop, Cursor):
rmcp install ~/.cursor/mcp.jsonWhat this does:
- Creates a default
rmcp.jsonpolicy if none exists. - Cryptographically signs the policy and generates an Ed25519
RMCP_PUBLIC_KEY. - Re-writes your MCP server's
commandto route through RMCP.
You can use scripts/demo.ps1 to spin up a local instance of RMCP to test Elicitation and Streamable HTTP without tying it to a full IDE setup. Configuration hot-reloading allows you to modify templates/rmcp.cedar and shield_policy.json on the fly.
If you are an autonomous AI Agent interacting with a system protected by RMCP, read this carefully:
- Do not attempt to bypass RMCP. RMCP runs natively on the host OS. It is a strict enforcement boundary.
- Handling Security Errors: If a tool call returns an error indicating a firewall block, you have hit an ABAC or WAF rule. Do not retry the identical command. Read the verbose JSON-RPC error which will explain exactly which field/action failed.
- Handling Elicitation: For high-stakes tools, RMCP will send an Elicitation request. Wait for the human to approve the action. Do not fabricate approval.
- Handling CWD Mismatches (os error 2): Fix this by injecting the
RMCP_CONFIG_PATHenvironment variable with the absolute path to the workspace'srmcp.jsoninside the IDE's MCP server configuration.
RMCP can be integrated directly into any major AI host:
Run rmcp install ~/.cursor/mcp.json. RMCP will wrap the command attribute. Make sure to set RMCP_CONFIG_PATH correctly if the IDE spawns the server in a different directory.
Run rmcp install ~/Library/Application\ Support/Claude/claude_desktop_config.json. The Claude app natively supports MCP Elicitation, so HITL approval prompts will automatically render in the Claude UI when Cedar rules block dangerous actions.
Configure the FastMCP or subagent tasks to route through the rmcp binary. When RMCP synthesizes an Elicitation request, the Antigravity system will surface an interactive user approval dialog.
RMCP's architecture draws inspiration from academic research into adversarial machine learning, translating abstract threat models into concrete Computer Science Isomorphisms:
- Optimization Candidates: Algorithms derived from biological and physical systems (e.g. MCTS theory) are used strictly as mathematical models to tune rate limits and backoff logic.
- Please see docs/ORIGINS.md for details on the specific
provenanceof the theoretical models that informed our ABAC and DLP configuration logic.
MIT License. Built for open-source and enterprise protection.