Proxy-based secure model context protocol server access for artificial intelligence agents
A gateway securely executes model context protocol (“MCP”) processes for artificial intelligence (“AI”) agents by creating nano sandboxes in which the MCP processes execute. A server-sent events (“SSE”) bridge identifies a request to initialize an SSE channel with an MCP server, the request being sent from an MCP client that generates MCP-compliant commands in association with an AI agent. The SSE bridge instantiates a nano sandbox based on a definition extracted from the request, creating a custom and dynamic isolated execution environment. An MCP process is launched within the nano sandbox. The SSE bridge returns a session identifier, and receives a command and the session identifier. The SSE bridge authorizes the command and response by applying security rules, blocking either for non-compliance.
1 . A method for model context protocol (“MCP”) server access for artificial intelligence (“AI”) agents, comprising:
receiving a first request to utilize a first MCP server, the first request being received from an MCP client used by an AI agent;
determining that the first MCP server utilizes standard input/output (“STDIO”) transport; and
instantiating, by an SSE bridge, a nano sandbox based on a definition, wherein the definition is extracted from the first request or retrieved based on identification of the first MCP server, wherein the definition defines a restricted execution environment of the nano sandbox, wherein the definition is included in a hypertext transfer protocol (“HTTP”) header of the first request, and wherein the SSE bridge verifies that system resources and permissions indicated by the definition meet security rules prior to instantiating the nano sandbox; and
executing the first MCP server within the nano sandbox; and
determining that the first MCP server utilizes server-sent events (“SSE”) transport; and
opening a persistent connection for the first MCP server to stream messages back to the MCP client;
receiving a first resource command from the MCP client;
verifying that the first resource command complies with security rules;
transmitting the first resource command to the first MCP server;
validating an output of the first MCP server based on the security rules; and
causing the output to be sent to the MCP client.
2 . The method of claim 1 , wherein the nano sandbox is an ephemeral container that the SSE bridge terminates after sending the output to the MCP client.
3 . The method of claim 1 , wherein the nano sandbox is an ephemeral container that persists for additional resource commands after the SSE bridge sends the output to the MCP client.
4 . The method of claim 3 , wherein the SSE bridge returns a first message identifier to the MCP client, and wherein the first resource command comprises the first message identifier.
5 . The method of claim 4 , wherein the SSE bridge receives a ping response from the first MCP server prior to returning the first message identifier.
6 . The method of claim 1 , wherein the SSE bridge creates the nano sandbox using a bubblewrap command that restricts file system access to one or more specified directories.
7 . The method of claim 1 , further comprising receiving a second request to utilize a second MCP server, wherein the second MCP server executes in a different sandbox than the first MCP server.
8 . The method of claim 7 , further comprising receiving a second resource command that comprises a second message identifier that is different than a first message identifier for the first resource command, wherein the SSE bridge routes the first resource command to the nano sandbox based on the first message identifier and routes the second resource command to the different sandbox based on the second message identifier.
9 . The method of claim 1 , wherein a gateway receives resource commands from multiple different MCP clients, and wherein different tools are available to the multiple different MCP clients.
10 . The method of claim 1 , further comprising:
receiving a first list of available tools and instructions from the first MCP server;
at a later time, receiving a second list of resource profiles from the first MCP server;
determining a difference in first and second lists;
in an instance in which first MCP server utilizes STDIO transport, allowing the SSE bridge to route additional resource commands to the first MCP server; and
in an instance in which first MCP server utilizes SSE transport, blocking the SSE bridge from routing additional resource commands to the first MCP server.
11 . The method of claim 1 , further comprising:
providing a user interface (“UI”) that displays available tools and instructions for a plurality of MCP servers, comprising the first MCP server;
receiving UI selections from an administrative user to activate a subset of tools and instructions; and
prior to allowing the SSE bridge to route the first resource command to the first MCP server, verifying that first resource command is within the subset of tools and instructions.
12 . The method of claim 1 , further comprising:
based on detecting a new tool signature for the first MCP server, blocking the SSE bridge from using the first MCP server.
13 . The method of claim 1 , wherein verifying that the first resource command complies with the security rules comprises checking the first resource command for prompt injection.
14 . The method of claim 1 , wherein verifying that the first resource command complies with the security rules comprises checking the first resource command against a whitelist of allowed resource commands or a blacklist of disallowed resource commands.
15 . The method of claim 1 , wherein validating the output based on the security rules comprises checking the output for scripts prior to sending the output from a gateway to the MCP client.
16 . The method of claim 1 , wherein closing an SSE connection between the MCP client and the SSE bridge causes the SSE bridge to send a kill signal to the first MCP server and delete the nano sandbox.
17 . A non-transitory, computer-readable medium containing instructions for model context protocol (“MCP”) server access by gateway proxy for artificial intelligence (“AI”) agents, wherein the instructions are executed by at least one processor to perform stages comprising:
receiving a first request to utilize a first MCP server, the first request being received from an MCP client used by an AI agent;
determining whether the first MCP server utilizes standard input/output (“STDIO”) transport or server-sent events (“SSE”) transport;
in an instance in which first MCP server utilizes STDIO transport, at least:
instantiating, by an SSE bridge, a nano sandbox based on a definition, wherein the definition is extracted from the first request or retrieved based on identification of the first MCP server, and wherein the definition defines a restricted execution environment of the nano sandbox, wherein the definition is included in a hypertext transfer protocol (“HTTP”) header of the first request, and wherein the SSE bridge verifies that system resources and permissions indicated by the definition meet security rules prior to instantiating the nano sandbox; and
executing the first MCP server within the nano sandbox;
in an instance in which first MCP server utilizes SSE transport, at least:
opening a persistent connection for the first MCP server to stream messages back to the MCP client;
receiving a first resource command from the MCP client;
verifying that the first resource command complies with security rules;
transmitting the first resource command to the first MCP server;
validating an output of the first MCP server based on the security rules; and
causing the output to be sent to the MCP client.
18 . A system for model context protocol (“MCP”) server access by gateway proxy for artificial intelligence (“AI”) agents, the system comprising:
at least one physical non-transitory, computer-readable medium comprising instructions; and
at least one processor that executes the instructions to perform stages comprising:
receiving a first request to utilize a first MCP server, the first request being received from an MCP client used by an AI agent;
determining whether the first MCP server utilizes standard input/output (“STDIO”) transport or server-sent events (“SSE”) transport;
in an instance in which first MCP server utilizes STDIO transport, at least:
instantiating, by an SSE bridge, a nano sandbox based on a definition, wherein the definition is extracted from the first request or retrieved based on identification of the first MCP server, and wherein the definition defines a restricted execution environment of the nano sandbox, wherein the definition is included in a hypertext transfer protocol (“HTTP”) header of the first request, and wherein the SSE bridge verifies that system resources and permissions indicated by the definition meet security rules prior to instantiating the nano sandbox; and
executing the first MCP server within the nano sandbox;
in an instance in which first MCP server utilizes SSE transport, at least:
opening a persistent connection for the first MCP server to stream messages back to the MCP client;
receiving a first resource command from the MCP client;
verifying that the first resource command complies with security rules;
transmitting the first resource command to the first MCP server;
validating an output of the first MCP server based on the security rules; and
causing the output to be sent to the MCP client.