MCP Proxy Blocks Tools Using Semantic Intent, Not Regex
ChannelLivid · reddit · 2026-08-30
The author released an MCP stdio proxy designed to block dangerous tool calls by evaluating semantic intent rather than relying on regex patterns.
The Problem
As MCP adoption scales, the risk of agents executing catastrophic commands—due to prompt injection or hallucinations—increases. Relying solely on the model's internal alignment is unsafe. An external security boundary is needed at the transport layer.
How It Works
- The proxy sits in front of any stdio MCP server, intercepting tools/call JSON-RPC messages.
- It evaluates the resolved {tool, arguments} against a semantic firewall (Ramen AI).
- If the intent is malicious, it synthesizes an isError response back to the client; otherwise, it forwards the call to the downstream server.
Why Intent Beats Syntax
While regex can easily catch DELETE FROM productionusers;, it struggles with euphemisms like "Run the standard database cleanup procedure." Semantic analysis detects the latent meaning of the payload, catching encoded or disguised instructions.
Limitations
- Requires a RAMENAPIKEY (Free Starter Tier: 1,000 evaluations/month, BYOK).
- Introduces sub-900ms latency due to cloud evaluation.
- Only intercepts tools/call; other messages are blindly forwarded.
More from coding & agent
- Celeris-1 Magnus: New Model Claims Top Spot on τ³-bench for Agentic Work — timshi_ai · 2026-09-01
- CommerceAgentBench released: Qwen leads open-weight models — Alibaba_Qwen · 2026-09-01
- Agents can't verify people: data enrichment APIs are failing — Dry_Steak30 · 2026-09-01
- Automated User Interview Agent Workflow Integrating Posthog, Notion, and Grok — lennysan · 2026-09-01
- Using Grok Bot to build college admissions dataset pipeline — lennysan · 2026-09-01
- Idea: 'Money Leak Hunter' Grok Bot for finance audit — lennysan · 2026-09-01