Dvarapala — security gateway for MCP

What it stops

Dvarapala doesn't reinvent detection — it composes battle-tested OSS (gitleaks, Microsoft Presidio, ProtectAI llm-guard) into an MCP-aware enforcement layer, plus two novel detectors only the gateway can do.

novel

Tool poisoning

Malicious instructions hidden in tool descriptions are flagged before the LLM ever reads them. Regex on prompt-injection patterns, always on.

novel

Tool mutation / rug-pull

Cross-restart SHA-256 fingerprints catch tool definitions silently changing between sessions — the supply-chain attack unique to MCP.

gitleaks

Secrets leakage

AWS keys, GitHub tokens, GCP creds, JWTs, private keys — 150+ rules from gitleaks, embedded as a Go library. JSON-aware redaction preserves message validity.

presidio

PII / PHI / PCI

50+ recognizers via Microsoft Presidio sidecar. HIPAA, GDPR, PCI-aware. Opt-in via DVARAPALA_PRESIDIO_URL.

llm-guard

Indirect prompt injection

ML model + heuristics catch injection in tool outputs that would otherwise hijack the LLM. Via ProtectAI llm-guard sidecar.

native

Destructive actions

rm -rf, DROP TABLE, dd if=…of=/dev/sd*, mkfs — denied at the gateway before ever reaching the shell.

How it fits

One static binary. Three deployment shapes — all sharing the same engine, detectors, audit log, and policy YAML.

┌─────────────────────────────────────────┐ │ LLM client (Claude Code, Cursor) │ │ ┌────────────────┐ ┌─────────────────┐ │ │ │ Built-in tools │ │ 3rd-party MCPs │ │ │ │ Read, Bash … │ │ github, postgres│ │ │ └───────┬────────┘ └────────┬────────┘ │ │ │ │ │ │ Anthropic perms ┌────▼─────┐ │ │ │ Dvarapala│ ←── │ │ └────┬─────┘ │ └──────────────────────────────────┼──────────┘ ▼ Real MCP servers

Three transports

All three ship in one binary, all three reuse the same policy + detector pipeline.

wrap — stdio passthrough for npx-based MCPs. Drops into Claude Code / Desktop / Cursor / Cline configs.
proxy — HTTP / Streamable-HTTP / SSE relay for hosted MCPs (Atlassian, Sentry, internal microservices).
hub — one Dvarapala fronting many MCPs — the enterprise shape.

What you see

Every JSON-RPC message in either direction is parsed, evaluated, audited. dvarapala logs renders the audit stream as a per-MCP, per-tool, per-action timeline.

~ — dvarapala logs -f

$ dvarapala logs -f

14:03:01  deepwiki      →  allow   tools/list
14:03:02  deepwiki      ←  allow   tools/list → 3 tools
14:03:02  filesystem    →  allow   tools/list
14:03:02  filesystem    ←  allow   tools/list → 14 tools
14:03:59  deepwiki      →  allow   ask_question(repoName="facebook/react", question="What is React?")
14:04:04  deepwiki      ←  allow   ask_question → React is a JavaScript library for building UIs…
14:05:11  filesystem    ←  redact  read_file → key=[REDACTED:aws-access-token]
            // Secret in tool output redacted (gitleaks)  [redact-secrets-in-tool-output]
14:06:30  shell         →  deny    exec(command="rm -rf /")
            // Destructive shell command blocked  [deny-destructive-actions]

Composed, not reinvented

Detection of well-defined classes is delegated to existing OSS — Dvarapala is the MCP-aware layer that glues them together.

gitleaks

150+ secret-detection rules, embedded as a Go library. No subprocess, no network call.

Microsoft Presidio

PII / PHI / PCI recognition, 50+ entity types. Sidecar HTTP service.

ProtectAI llm-guard

Prompt-injection detection (ML + heuristics). Sidecar HTTP service.

NVIDIA garak + Azure PyRIT

Adversarial test scenarios, curated into the attack-corpus fixture format.

mark3labs/mcp-go

Typed MCP message structs where useful; raw JSON-RPC where transparency matters.

GoReleaser

Cross-platform binaries, signed checksums, SBOMs, multi-arch container images, all in one config.