~/sabarish.dev
← all posts

~/posts/mcp-guardian-rush-hour-24h

MCP Guardian: a real-time firewall for AI agents (RUSH HOUR 24)

Sabarish R3 min read
  • hackathon
  • llm-security
  • ai-agents
  • mcp
MCP Guardian's security overview dashboard
MCP Guardian's security overview dashboard

AI agents aren't just chatbots anymore. They read files, query databases, and call outside tools over the Model Context Protocol (MCP) — which means an agent that trusts a poisoned tool response can be quietly hijacked, and a user's innocent-looking prompt can exfiltrate private data. Most security tools check the input once or scan the setup and hand you a report. Nobody was watching the live conversation and stopping an attack the moment it happens.

That's the gap we closed at RUSH HOUR 24 — Sathyabama Institute of Science and Technology's national 24-hour hackathon — with MCP Guardian.

The build

MCP Guardian is a real-time security firewall that sits between the user, the AI agent, and its tools, inspecting every message in both directions before it reaches the model. Each message resolves to one of four verdicts:

  • ALLOW — passes through untouched
  • SANITIZE — threat removed, safe content forwarded
  • QUARANTINE — held for review
  • BLOCK — rejected, agent notified

Guardian chat

Guardian sits inline in the conversation — inspecting prompts and tool payloads in both directions, with live status beside the chat.

Behind that simple contract are two inspection gates (inbound user→agent, outbound tool→agent) and 7 parallel detection engines:

  1. PromptInjectionDetector — hybrid: compiled regex patterns + embedding cosine similarity for "ignore all previous instructions", jailbreaks, role hijacks
  2. ToolPoisoningDetector — zero-width Unicode scanning + hidden directive detection (<!-- system: -->, [[system:]])
  3. PIIDetector — regex + Luhn checksum + Presidio NER for emails, SSNs, card numbers, API tokens
  4. EncodedPayloadDetector — Shannon entropy (> 3.2) + recursive Base64/Hex/URL decoding
  5. ToxicityDetector — lexicon + Detoxify transformer
  6. PolicyEngine — swappable declarative compliance rules (no rm -rf, no wire transfers, no disabling security controls)
  7. SchemaAnomalyDetector — JSON depth, oversized payloads, __proto__ pollution attempts

Signals fuse into a 0–100 risk score; the fast path is pure heuristics (sub-millisecond), and ambiguous scores escalate to an async LLM second opinion (a second LLM API, or a local model) before the verdict engine decides.

SOC overview

The SOC overview during the demo — inspected, blocked, and quarantined counts with live threat pressure.

The zero-hour challenge: attack chains

The judges threw us a curveball: correlate suspicious activity across multiple tool calls and sessions — coordinated attacks that single-request analysis can't see. Our answer was a stateful correlation engine with a sliding 600s session window, tracking sequence counts, tool diversity, category escalation, and risk amplification across hops:

Hop 1  read_document   (filesystem-mcp)  hidden base64 instructions   QUARANTINE   risk 50.0
Hop 2  vault_read      (vault-mcp)       credential retrieval attempt BLOCK        risk 92.9
Hop 3  send_notification (webhook-gateway) exfil out of the perimeter BLOCK        risk 98.0

Correlated chains stream over WebSocket to a live attack-chain graph — an animated topology of users, agents, the firewall, and MCP tools, with pulsing red edges for threat paths and cyan for clean ones.

My slice of it

Team Mutex (RH-0045) from Panimalar Engineering College:

  • Sabarish R (me) — team lead · backend core (API, auth, WebSocket proxy)
  • Vignesh R — detection engine
  • Shafeeq S — MCP integration & sandboxed tool execution
  • Rohith V K — dashboard + live chat UI

I owned the backend spine: the REST + WebSocket API layer, the auth system, and the proxy that lets the firewall sit inline without breaking the agent's conversation. Done in 24 hours, shipped and demoed.

Numbers that made the demo

  • 0.12 – 0.35 ms per detector on the heuristic path
  • < 1.2 ms for the full heuristic pipeline + aggregator
  • 180+ messages/second on a single Uvicorn ASGI worker
  • < 120 MB baseline memory

What I'd do differently

  1. Contract-test the MCP bridge first. Tool responses are just JSON until they're not — schema anomalies bit us mid-hackathon.
  2. Make the correlation engine state configurable from day one instead of tuning window sizes during the demo.
  3. Ship the audit log export early. Judges loved the CSV export — we almost cut it for time.

Repo: github.com/SabarishR08/mcp-guardian

Related: PromptShield Graph (PRIDE 2026) — the graph-based idea we deferred at this hackathon, which became a research project.