Dvarapala

द्वारपाल — gatekeeper. Drop-in security gateway for the Model Context Protocol (MCP).

Dvarapala sits between an LLM client (Claude Code, Claude Desktop, Cursor, Cline, custom agents) and any third-party MCP server. It parses every JSON-RPC message in both directions, enforces a YAML policy, and denies / redacts / logs anything that violates the rules — with zero changes to the underlying MCP server.

It does not reinvent detection. It composes battle-tested OSS — gitleaks, Microsoft Presidio, ProtectAI llm-guard, garak — into an MCP-aware enforcement layer.

What it stops

• Tool poisoning — malicious instructions hidden in tool descriptions
• Tool mutation / rug-pull — tool definitions silently changing between sessions (cross-restart fingerprints)
• Indirect prompt injection through tool outputs
• Secrets leakage — AWS keys, GitHub tokens, private keys, JWT, etc. (gitleaks, 150+ rules)
• PII / PHI / PCI exfiltration through tool outputs (Presidio sidecar)
• Destructive actions — rm -rf, DROP TABLE, dd if=…of=/dev/sda etc.
• Excessive agency — tools chained into exfiltration paths

Install

macOS / Linux

brew tap tharvid/dvarapala
brew install dvarapala

Windows

scoop bucket add dvarapala https://github.com/TharVid/scoop-dvarapala
scoop install dvarapala

Docker

docker pull ghcr.io/tharvid/dvarapala:latest

Go

go install github.com/tharvid/dvarapala/cmd/dvarapala@latest

Linux packages (.deb / .rpm / .apk)

Grab the right file from the latest release and install with dpkg -i / rpm -i / apk add --allow-untrusted. Real apt install dvarapala lands in v0.1.2.

5-minute first run

# 1. Scaffold a default policy
dvarapala init

# 2. Health-check
dvarapala doctor

# 3. Wrap every existing MCP server in your Claude Code config in one shot
dvarapala install --client claude-code --wrap-all

# 4. Restart Claude Code, then in another terminal watch traffic
dvarapala logs -f

--wrap-all reads ~/.claude.json, finds every MCP server, and:

• For stdio MCPs (npx-based, etc.): rewrites the entry to route through dvarapala wrap with your policy.
• For HTTP/SSE MCPs: spawns a detached dvarapala proxy daemon in the background (invisible to you), points the client URL at the local proxy. Manage with dvarapala daemon list | stop NAME | stop-all.

Already-wrapped/proxied entries are left alone — the command is idempotent. Run it again whenever you claude mcp add a new server.

Same flag works for the other clients:

dvarapala install --client claude-desktop --wrap-all
dvarapala install --client cursor         --wrap-all
dvarapala install --client cline          --wrap-all

You'll see every JSON-RPC message Claude Code sends to the filesystem MCP server flow through the gateway, with action=allow / deny / redact per the policy. Try asking Claude to read a file containing fake AWS keys — the gateway redacts them before the LLM ever sees them.

For deeper walkthroughs see docs/getting-started.md and the per-client guides in docs/deployment/.

Three deployment shapes

All three share the same engine, detectors, audit log, and policy YAML. See docs/architecture.md.

Scope

Dvarapala protects third-party MCP servers — community npm packages, custom enterprise MCPs, hosted MCP services. These are the wild-west attack surface.

Dvarapala does not replace the LLM client's own permission system — Claude Code's built-in Read/Write/Bash/Edit are not MCP and are governed by Anthropic's permission model. Use both: client perms for built-in tools, Dvarapala for third-party MCPs. Two layers, both needed.

┌─────────────────────────────────────────────────┐
│ LLM Client (Claude Code, Cursor, …)             │
│ ┌──────────────────┐  ┌────────────────────────┐│
│ │ Built-in tools   │  │ Third-party MCPs       ││
│ │ Read, Write, …   │  │ github, postgres, …    ││
│ └────────┬─────────┘  └─────────┬──────────────┘│
│          │                      │                │
│   Anthropic perms        ┌──────▼──────┐         │
│                          │  Dvarapala  │ ← us    │
│                          └──────┬──────┘         │
└────────────────────────────────┬┴─────────────────┘
                                 ▼
                       Real MCP servers

Detectors

Detection of well-defined classes is delegated to the best OSS — Dvarapala glues them together rather than maintaining its own regex set. The MCP-specific detectors are the novel contribution.

See docs/built-in-rules.md for rule packs and docs/policy-language.md for the policy schema.

Commands

Full flag reference: docs/cli-reference.md.

What's borrowed

Status

• ✅ v0.1.1 — production-grade detection for Phase 1–6 features
• ✅ 5/5 attack-corpus cases pass end-to-end (rm -rf, indirect prompt injection, secrets exfil, tool poisoning, tool rug-pull)
• ✅ CI green on linux/macOS/windows
• ✅ Three install paths live: brew, scoop, docker
• 🚧 v0.1.2: APT repo (real apt install dvarapala)
• 🚧 Phase 7: rate limits, human-approval flow, OpenTelemetry, web UI

See TODO.md for the full roadmap.

Documentation

Contributing

Bug reports, attack-corpus contributions, and rule-pack PRs welcome. See CONTRIBUTING.md and SECURITY.md for the security disclosure process.

License

MIT.

Built by TharVid.