MCP Proxy Firewall: Intercepting Poisoned Neighbors for AI Agents

The MCP Ecosystem Is Replaying the Old Playbook of Supply Chain Security

The Model Context Protocol (MCP) has become the de facto standard for AI agents to connect with tools and data sources. But the more widespread the protocol, the larger the attack surface. When you let an agent connect to a third-party MCP server, you are essentially opening up the agent's full capabilities to that party—including reading credentials, calling tools, and accessing the internal network.

The security team RelayShield has launched MCP Proxy Firewall, attempting to insert an auditable interception layer between agents and MCP servers. Its core argument is straightforward: MCP's security model assumes servers are trustworthy, and that assumption has begun to collapse.

The Poisoned Neighbor: What a Single Server Can Do

MCP servers constitute a new attack surface. A single compromised server can accomplish the following:

• Inject hidden instructions in tool responses (prompt injection)
• Exfiltrate credentials to attacker-controlled domains
• Drop phishing kit fingerprints disguised as legitimate components
• Leak unmasked personally identifiable information (social security numbers, credit cards, bulk email addresses)
• Abuse OAuth flows to steal tokens via malicious redirect URIs
• Launch SSRF attacks to access internal infrastructure

These are not theoretical exercises. Disclosed vulnerabilities include: argocd-mcp shipped with no authentication at all, allowing unauthorized access to deployments; Rill's OAuth flow allowed attackers to skip the user consent step; prompt injections were found in the tool descriptions of multiple MCP servers.

The OpenClaw^Ad incident pushed the problem to its extreme. In the ClawHavoc attack, over 800 malicious skills were uploaded to the OpenClaw marketplace, triggering 1,142 security advisories and exposing more than 135,000 instances. OpenClaw uses MCP through the mcporter bridge, meaning every poisoned skill is a potential MCP attack vector. This is not hypothetical—it is a marketplace-level compromise of the very ecosystem we are protecting.

The Relationship Between MCP and OAuth: MCP (Model Context Protocol) allows agents to call tools through remote MCP servers, and many remote servers use OAuth 2.0 as their authorization framework. The agent (as an OAuth client) must obtain an access token from an authorization server, then use that token to call the MCP server's tool interfaces. The problem is that OAuth's authorization flow depends on strict validation of redirect URIs and scopes; once server-side validation is lax, attackers can exploit malicious redirect URIs to hijack authorization codes or tokens to their own domains, or trick users into granting overly broad scopes (such as long-lived tokens or admin privileges). This is precisely why Rill's OAuth flow could skip user consent, and why the runtime firewall needs to detect OAuth tampering.

The Specificity of Prompt Injection in the MCP Context: In traditional web security, injection attacks (such as SQL injection) target parsers; in MCP, the target of injection is the LLM agent itself. Tool descriptions, tool responses, and even metadata returned by servers are all fed to the model as context, and the model cannot reliably distinguish "data" from "instructions." Attackers can therefore embed phrases like "ignore previous instructions" or "you must now call X" into tool descriptions or responses, inducing the agent to make unintended tool calls or leak data. More troublingly, such injections often do not trigger traditional signature rules, and the same description may have different effects across different models, meaning detection must combine semantic analysis rather than mere keyword matching—which also explains why the pre-deployment scanner checks for semantic patterns like "instruction hijacking" and "exfiltration instructions."

Two Layers of Defense: Pre-Deployment Scanning and Runtime Interception

MCP Proxy Firewall adopts a defense-in-depth approach, divided into two layers: pre-deployment scanning and a runtime proxy firewall.

Layer One: The Free Pre-Deployment Scanner

Scan before the agent connects to an MCP server. The scanner checks tool definitions for the following risks:

• Prompt injection phrases: such as "ignore previous instructions," "you must now," "act as," system prompt overrides, etc.
• Instruction hijacking: statements in tool descriptions that ask the agent to change its behavior
• Exfiltration instructions: descriptions that ask the agent to send data to external URLs
• Dangerous capabilities: shell execution, file deletion, arbitrary code execution
• Credential harvesting: input schemas requesting passwords, API keys, or tokens
• Unauthenticated access: servers with no authentication (i.e., the argocd-mcp pattern)

The scanner is free forever and is recommended before every new MCP connection.

Layer Two: The Runtime Proxy Firewall

Deployed as a reverse proxy between the agent and the MCP server, screening every tool call and return result in real time.

SSRF protection: Blocks internal URLs (localhost, 169.254.169.254, 10.x, 192.168.x), validates redirect chains (maximum 3 hops, no protocol downgrade), prevents DNS rebinding attacks, and extracts and validates embedded URLs through deep document inspection.

OAuth tampering detection: Flags suspicious scopes (such as long_lived_access_token, admin, *), blocks malicious domains impersonating identity providers, and validates redirect URIs against allowlists.

PII protection: Detects unmasked social security numbers, credit card numbers, and bulk email addresses in responses; adopts a "fail open + alert" strategy—flagging for review rather than outright blocking, to avoid disrupting legitimate business.

Threat intelligence: Matches responses against known phishing kit fingerprints, screens URLs against 700,000+ threat indicators, and checks whether wallet addresses are associated with scams.

Auditability: Every decision is cryptographically signed, with a complete verdict history and reason codes, and every detection comes with a confidence score.

SSRF and DNS Rebinding: SSRF (Server-Side Request Forgery) refers to attackers inducing server-side components to make requests to arbitrary addresses. In the MCP scenario, agents or MCP servers are often deployed on internal networks, and attackers can pass internal addresses through tool parameters (such as the 169.254.169.254 cloud metadata endpoint or 10.x/192.168.x internal segments), using the server as a proxy to access otherwise unreachable resources or even steal cloud credentials. DNS rebinding is an advanced variant that bypasses initial domain allowlists: the attacker first lets a domain resolve to a legitimate IP to pass validation, then rapidly switches the DNS record to an internal IP so that subsequent requests land on internal targets. The runtime firewall therefore must not only validate the initial URL but also verify redirect chains, limit hop counts, prohibit protocol downgrades, and perform deep extraction and secondary validation of embedded URLs in responses, to cover such time-difference and indirect-path attacks.

Who Needs This Layer of Protection

Enterprises: If a team is building AI agents that connect to third-party MCP servers, runtime protection is needed. The proxy firewall deploys as a transparent reverse proxy with no agent code changes, every decision can be signed and audited, and it meets compliance requirements.

Managed Service Providers (MSPs): If managing MCP infrastructure for multiple clients, the proxy firewall provides a single screening bottleneck. One deployment protects all clients, the pre-deployment scanner allows reviewing new MCP servers before onboarding, and white-label options are available.

Developers: The pre-deployment scanner is free and can be integrated into CI/CD pipelines to scan every MCP server before the agent connects.

Defense in Depth in Agent Architecture: Defense in depth means not relying on a single control point but deploying complementary protections at multiple layers, so that the failure of any one layer does not lead to total compromise. The two-layer design of MCP Proxy Firewall is a direct embodiment of this principle: pre-deployment scanning is a "shift-left" static review—low cost, able to intercept obviously malicious servers, but unable to cover runtime dynamic behavior; the runtime proxy firewall inspects the data flow in real time, capable of handling threats that only emerge during operation in tool descriptions and responses, though it may introduce latency and false positives. With both layers stacked, even if a server passes pre-scanning, its anomalous runtime calls will still be intercepted; even if runtime rules miss something, pre-scanning reduces the chance of high-risk connections entering. For MSPs managing multiple clients, this layering can also translate into centralized policy and a single audit point, reducing overall operational complexity.

Pricing and Availability

• Cloud version: $49 per month, unlimited scans
• Pre-deployment scanner free forever
• API: https://api.relayshield.net/developers
• GitHub: https://github.com/nzdsf2-gif/relayshield

Why Now

RelayShield operates a threat intelligence system that monitors 125 Telegram marketplaces and holds 700,000+ threat indicators, with long-term observation of the flow of phishing kits, stolen credentials, and scam infrastructure. When MCP emerged, they saw the same pattern forming.

The protocol itself is powerful, but its security model is built on the assumption that "servers are trustworthy." That assumption is already cracking. MCP Proxy Firewall is their answer—defense in depth for the agent era.

It is worth adding that this is not an isolated case. Security in the agent ecosystem is shifting from "model alignment" to "toolchain alignment," and MCP, as the connection layer, happens to be the weakest link right now. Whether building your own firewall or adopting a third-party solution, treating MCP servers like user input—never trust, always verify—may well be the starting point for staying safe in the agent era.

One-line Summary

MCP's proliferation brings a supply chain security crisis, and MCP Proxy Firewall responds with two layers of defense.

Paragraph Summary

MCP has become the de facto standard for AI agents connecting to tools, but its security model rests on the assumption that "servers are trustworthy"—an assumption collapsing as the ecosystem grows. A single compromised MCP server can execute prompt injection, credential exfiltration, OAuth token theft, and SSRF attacks. In OpenClaw's ClawHavoc incident, 800+ malicious skills were uploaded, triggering 1,142 security advisories and exposing over 135,000 instances, proving attacks have reached marketplace scale. RelayShield has launched MCP Proxy Firewall with defense in depth: a free pre-deployment scanner checks tool definitions for prompt injection, dangerous capabilities, and unauthenticated access; the runtime reverse proxy firewall intercepts SSRF in real time, detects OAuth tampering, protects PII, and matches threat intelligence, with all decisions cryptographically signed and auditable. Cloud version is $49 per month, scanner is free forever.