Block MCP Cross-Tool Leaks with Sluice
nomadic_tech · reddit · 2026-07-16
The author shared a real-world leak scenario: Claude read an API key from a config file via the file system MCP and almost included it in a drafted email. Existing MCP security tools mostly inspect single messages and fail to connect sequential tool calls.
To fix this, they built Sluice: a proxy sitting between the MCP client and server that scans JSON-RPC messages bidirectionally and retains a memory of sensitive values for the session. If a value from an earlier tool response appears in a subsequent tool call, it blocks it with a taintleak.
The post also details integration and features: supports stdio / HTTP / streamable HTTP; detects secrets, PII, tool-poisoning, and prompt-injection heuristics; clean path p50 overhead is 0.02 ms, and 0.61 ms with detection enabled. It includes local SQLite audit logs, no telemetry, and is Apache 2.0 licensed. An external review found three real bugs, which have been fixed in v0.3.3 with regression tests added.
More from coding & agent
- A better path to agent autonomy is running waves, finding friction, and iterating — JnBrymn · 2026-07-22
- Coding agents are heading toward an AI-writes, AI-reviews, human-approves workflow — aftahi_ai · 2026-07-22
- oMLX 0.5.2 adds Mac menu-bar stats, low-bit decode kernels, and faster downloads — awnihannun · 2026-07-22
- GitHub review bot hits its PR limit and forces a 39-minute cooldown — DanielLockyer · 2026-07-22
- Max reasoning effort appears to be mobile-only in Codex Remote, not desktop — GabGarrett · 2026-07-22
- A Reddit demo argues online stores should expose carts and pricing through MCP — gelembjuk · 2026-07-22