MCP Proxy Blocks Tools Using Semantic Intent, Not Regex
ChannelLivid · reddit · 2026-08-30
The author released an MCP stdio proxy designed to block dangerous tool calls by evaluating semantic intent rather than relying on regex patterns.
The Problem
As MCP adoption scales, the risk of agents executing catastrophic commands—due to prompt injection or hallucinations—increases. Relying solely on the model's internal alignment is unsafe. An external security boundary is needed at the transport layer.
How It Works
- The proxy sits in front of any stdio MCP server, intercepting tools/call JSON-RPC messages.
- It evaluates the resolved {tool, arguments} against a semantic firewall (Ramen AI).
- If the intent is malicious, it synthesizes an isError response back to the client; otherwise, it forwards the call to the downstream server.
Why Intent Beats Syntax
While regex can easily catch DELETE FROM productionusers;, it struggles with euphemisms like "Run the standard database cleanup procedure." Semantic analysis detects the latent meaning of the payload, catching encoded or disguised instructions.
Limitations
- Requires a RAMENAPIKEY (Free Starter Tier: 1,000 evaluations/month, BYOK).
- Introduces sub-900ms latency due to cloud evaluation.
- Only intercepts tools/call; other messages are blindly forwarded.
More from coding & agent
- Simon Willison: code mode is the future of tool calling, if it can be sandboxed — springrod · 2026-10-16
- Dev workflow: Astra for tedious tasks, Claude for ideas not implementation — menhguin · 2026-10-16
- Agent named 'Ilya' reportedly scores 1.1pt higher on benchmarks — daniel_mac8 · 2026-10-16
- Gemini CLI fix: substring matching inlined unrequested binary files into model context — priyanshu1976 · 2026-10-16
- Building AI agents on real healthcare claims data: the domain work that makes them work — alex_verem · 2026-10-16
- OpenAI stealth-testing mysterious internal model 'Aeon' in Codex desktop app and Dots — cedric_chee · 2026-10-16