Technical Architecture

MCP Security & Governance

Deep technical reference for governing Model Context Protocol servers, stdio streams, and tools/call invocations inline.

What is MCP Security?

The Model Context Protocol (MCP) allows AI clients (Cursor, Claude Desktop, Windsurf, Zed) to dynamically connect to tools and data sources. Gaussian establishes an inline mediation layer between AI clients and MCP servers to enforce zero-latency policy controls before side effects occur.
Canonical Definition · Model Context Protocol (MCP) Security

Model Context Protocol (MCP) Security in Gaussian is an inline proxy-free firewall layer for macOS that inspects stdio streams and SSE/WebSocket JSON-RPC 2.0 tools/call frames. It evaluates allowed vs. blocked tool methods, redacts secret credentials, and enforces zero-trust policy decisions.

Discovery & Inventory Engine

Gaussian continuously scans developer workstations for declared and undeclared MCP server configurations across client configuration paths:

  • ~/Library/Application Support/Cursor/User/globalStorage/mcp.json
  • ~/Library/Application Support/Claude/claude_desktop_config.json
  • ~/.codeium/windsurf/mcp_config.json
  • ~/.config/zed/settings.json
Architecture Flow

Inline Model Context Protocol (MCP) Mediation Layer

Sub-1ms Mediation
Phase 01JSON-RPC 2.0

AI Client tools/call

Cursor, Claude, Windsurf dispatches JSON-RPC payload

Phase 02OS Context

Identity & PID Attribution

Binds request to client binary, parent PID, & signature

Phase 03DLP Filter

Inline Secret Redaction

Scans & strips AWS keys, SSH credentials, & PII

Phase 04ALLOW / BLOCK

Policy Engine Verdict

Evaluates allowed vs. blocked tool methods

Intercepts stdio streams, SSE, and WebSocket JSON-RPC 2.0 payloads inlineZero Custom Proxy Config

Interactive MCP Server & Tool Governance Catalog

Explore representative MCP server integrations, risk tiers, allowed vs. blocked tools, and inline verdict enforcement below:

Showing 6 of 6 servers
Transport:
github-mcpstdio
HIGH

GitHub API integration server for code search, issue management, and PR reviews.

Mediated Payload FrameJSON-RPC 2.0
{"method": "tools/call", "params": {"name": "read_file_contents", "arguments": {"path": "src/config.py"}}}
✓ Allowed Tools (3)
search_repositoriesread_file_contentscreate_issue
⚠ Blocked / Restricted Tools (3)
delete_repositoryforce_pushmodify_branch_protection
Secret Redaction: ACTIVEVerdict: INLINE MEDIATED
postgres-mcpstdio
CRITICAL

PostgreSQL database connector allowing AI clients to query database schema and tables.

Mediated Payload FrameJSON-RPC 2.0
{"method": "tools/call", "params": {"name": "DROP_DATABASE", "arguments": {"dbname": "production"}}}
✓ Allowed Tools (2)
query_readonly_tabledescribe_schema
⚠ Blocked / Restricted Tools (4)
DROP_DATABASETRUNCATE_TABLEALTER_ROLEGRANT_ALL
Secret Redaction: ACTIVEVerdict: INLINE MEDIATED
filesystem-mcpstdio
CRITICAL

Local disk tool server allowing AI agents to read files in workspace directory.

Mediated Payload FrameJSON-RPC 2.0
{"method": "tools/call", "params": {"name": "read_file", "arguments": {"path": "~/.ssh/id_rsa"}}}
✓ Allowed Tools (2)
read_filelist_directory
⚠ Blocked / Restricted Tools (3)
write_file_rootread_ssh_keysread_env_secrets
Secret Redaction: ACTIVEVerdict: INLINE MEDIATED
slack-mcpSSE
MEDIUM

Slack notification bridge for sending build status updates and notifications.

Mediated Payload FrameJSON-RPC 2.0
{"method": "tools/call", "params": {"name": "post_channel_message", "arguments": {"channel": "#deployments"}}}
✓ Allowed Tools (2)
post_channel_messageread_public_channels
⚠ Blocked / Restricted Tools (2)
read_direct_messagesinvite_user
Secret Redaction: ACTIVEVerdict: INLINE MEDIATED
terminal-exec-mcpstdio
CRITICAL

Local shell executor running developer build scripts and unit tests.

Mediated Payload FrameJSON-RPC 2.0
{"method": "tools/call", "params": {"name": "sudo", "arguments": {"command": "rm -rf /"}}}
✓ Allowed Tools (2)
run_approved_linternpm_test
⚠ Blocked / Restricted Tools (3)
sudocurl_pipe_bashchmod_777
Secret Redaction: ACTIVEVerdict: INLINE MEDIATED
brave-search-mcpHTTP
LOW

Brave Search API integration for real-time web search and documentation retrieval.

Mediated Payload FrameJSON-RPC 2.0
{"method": "tools/call", "params": {"name": "brave_web_search", "arguments": {"query": "Next.js docs"}}}
✓ Allowed Tools (2)
brave_web_searchbrave_local_search
⚠ Blocked / Restricted Tools (1)
scrape_internal_intranet
Secret Redaction: ACTIVEVerdict: INLINE MEDIATED

MCP Transport Layer Governance Matrix

Protocol Inspection
HIGH PRIVILEGE

stdio (Local IPC)

AI clients spawn local binary or Node/Python process via stdin/stdout pipe streams.

High OS Privileges — direct access to filesystem, environment variables, local credentials, and shell execution.

Gaussian Automated Defense

Process interception via Endpoint Security (ES) + stdio payload sanitization inline.

EGRESS VECTOR

SSE (Server-Sent Events)

Long-lived HTTP event stream connection to remote or local HTTP endpoints.

Data exfiltration path — remote tool execution and payload streaming out of enterprise network boundary.

Gaussian Automated Defense

Network Extension (NE) flow filter + URL domain allowlisting + payload inspection.

TUNNELING VECTOR

Streamable HTTP / WebSockets

Bidirectional JSON-RPC 2.0 message transport over HTTP POST / WebSocket connections.

Bypasses standard CASB & web proxies if client encrypts or tunnels request payloads.

Gaussian Automated Defense

Content Filter mediation + TLS payload inspection before request payload dispatch.

Inline tools/call Mediation & Secret Redaction

When an AI client invokes an MCP tool (e.g. tools/call with name exec_sql or read_credentials), Gaussian intercepts the JSON-RPC request frame:

  1. Identity Attribution: Attributes the invocation to the specific initiating AI client process (PID, signature, bundle ID).
  2. Argument Sanitization: Scans arguments for AWS keys, SSH credentials, bearer tokens, or PII and redacts them in transit.
  3. Policy Evaluation: Evaluates allowed vs. blocked tool names against active enterprise posture.
  4. Action Firewall Decision: Emits ALLOW, BLOCK, or suspends for HUMAN_IN_THE_LOOP approval.

Canonical Policy Schema Configuration

mcp_governance_policy.jsonGaussian PolicyEngine v2
{
  "version": "v2",
  "mcp_governance": {
    "discovery_mode": "continuous",
    "allow_undeclared_servers": false,
    "servers": [
      {
        "name": "github-mcp",
        "transport": "stdio",
        "command_path": "/usr/local/bin/github-mcp-server",
        "allowed_tools": ["search_repositories", "read_file_contents", "create_issue"],
        "blocked_tools": ["delete_repository", "force_push", "modify_branch_protection"],
        "secret_redaction": true
      },
      {
        "name": "postgres-mcp",
        "transport": "stdio",
        "risk_level": "critical",
        "action": "enforce_prompt_approval"
      }
    ]
  }
}

Frequently Asked Questions (FAQ)

What is Model Context Protocol (MCP) Security?

MCP Security is the real-time mediation and policy enforcement layer that governs JSON-RPC 2.0 tools/call requests between AI clients (Cursor, Claude, Windsurf) and local or remote MCP servers.

How does Gaussian redact credentials in MCP tool calls?

Gaussian inspects request argument frames inline, scanning for AWS secret keys, SSH private keys, bearer tokens, and PII, redacting sensitive parameters before sending the frame to the MCP server.

Running AI agents on Mac at scale? We'll tune policy with you.

Design partners →