feat: MCP gateway, response DLP, shared proxy infrastructure#34
Merged
chen-zichen merged 6 commits intomainfrom Feb 27, 2026
Merged
feat: MCP gateway, response DLP, shared proxy infrastructure#34chen-zichen merged 6 commits intomainfrom
chen-zichen merged 6 commits intomainfrom
Conversation
Remove demo.tape, demo-full.tape, and demo-agent.py (obsoleted by the new VHS-based TUI demo). Add demo-tui.tape, demo-acp.sh, and simplify demo-attack.sh (12 requests) and demo-mock.py (2 canned responses). All demo files use fake paths, fake credentials, and environment variables for API keys — no privacy-sensitive data.
Extract ~750 lines of duplicated proxy infrastructure from acpwrap,
mcpgateway, and autowrap into a shared internal/jsonrpc package with
MethodConverter abstraction. Each protocol package is now a thin wrapper
(~25 lines) plus its protocol-specific converter function.
New internal/jsonrpc/ package:
- types.go: Message, ErrorResponse, LockedWriter, MethodConverter
- pipe.go: PipeInspect, PipePassthrough, SendBlockError
- proxy.go: RunProxy (unified subprocess lifecycle)
- signal_{unix,windows}.go: cross-platform signal forwarding
Bug fixes:
- Scanner buffer overflow now logged at WARN (was DEBUG)
- Signal-forwarding goroutine tracked in WaitGroup
- Tool name included in all block log messages
- Stdin pipe closed if stdout pipe creation fails
- Child stdout closed on Start() failure
Also adds mock MCP server (cmd/mock-mcp-server) and golangci-lint
exclusion for jsonrpc package name conflict with stdlib.
Net: -747 lines deleted, +2266 added → ~43% reduction in proxy code.
Add E2E tests that exercise the full proxy stack against @modelcontextprotocol/server-filesystem — a real MCP server doing actual file I/O. Tests verify initialize handshake, tools/list, allowed reads/writes returning real content, and blocked .env/.ssh access returning Crust error responses. - 8 E2E tests in internal/mcpgateway/e2e_test.go - Guarded with -short skip + npx availability check - New CI job (E2E Tests) with Node.js 22 + pre-installed server - Trimmed redundant unit tests now covered by E2E
Add docs/mcp.md with detailed MCP gateway guide — architecture diagram, supported servers, Claude Desktop config, auto-detect mode, blocking examples, and CLI flags. Update README with MCP Gateway section, grouped documentation table (Setup / Reference), and MCP column in how-it-works blocking matrix.
Close security gaps where server responses could leak secrets undetected: - Add Engine.ScanDLP() for standalone DLP scanning of arbitrary content - PipeInspect now scans response Result fields for DLP patterns before forwarding to the client (errors sent to client via fwdWriter) - MCP gateway outbound now uses MCPMethodToToolCall (was passthrough) - New BothMethodToToolCall combined converter for crust wrap outbound inspects both MCP and ACP methods in both directions - E2E tests against real @modelcontextprotocol/server-filesystem verify that files with embedded AWS keys and GitHub tokens are blocked by response DLP even when the file path passes inbound rules
cyyever
force-pushed
the
feat/gitignore-mp4
branch
from
03991fe to
53a1c31
Compare
Scan JSON-RPC error field for leaked secrets alongside the existing result field scanning. A malicious server could embed API keys in error messages to exfiltrate them.
zhangchen-xu
approved these changes
Feb 27, 2026
chen-zichen
approved these changes
Feb 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
request evaluation and outbound response DLP scanning. Works with any MCP server.
Method names are disjoint — no conflict.
before reaching the client. Catches malicious or misconfigured servers returning API keys/tokens in tool
results or error messages.
signal handling, and pipe inspection from the ACP-specific implementation — now shared across MCP, ACP, and
auto-detect modes.
including response DLP tests with files containing embedded AWS keys and GitHub tokens.
Test plan
go build ./...passesgo test -race ./...passesSecurity checklist