MCP安全控制

Vault — deny-by-default, safe reads allowed, writes require approval

vellaveto-proxy --protect vault -- ./my-server ```

<p align="center"> <img src="docs/shield-demo.gif" alt="VellaVeto Shield demo — blocking credential theft, data exfiltration, SANDWORM config injection, and prompt injection while allowing safe operations" width="880"> </p>

Fuzz (requires nightly)

cd fuzz && cargo +nightly fuzz run fuzz_json_rpc_framing -- -max_total_time=60 ```

See CONTRIBUTING.md for development rules and commit format.

Install (pick one):

cargo install vellaveto-proxy # From source (~2 min)

Setup Wizard

npx create-vellaveto

HTTP Reverse Proxy (deployed MCP servers)

cargo install vellaveto-http-proxy
VELLAVETO_API_KEY=$(openssl rand -hex 32) vellaveto-http-proxy \
  --upstream http://localhost:8000/mcp \
  --config policy.toml \
  --listen 127.0.0.1:3001

Docker

docker pull ghcr.io/paolovella/vellaveto:latest
docker run -p 3000:3000 \
  -v /path/to/config.toml:/etc/vellaveto/config.toml:ro \
  ghcr.io/paolovella/vellaveto:latest

Deployment Modes

See docs/DEPLOYMENT.md for configuration details.

Getting Started

Build

cargo build --release

Quick Start

Fortress — shield + system files, package configs, sudo approval, memory tracking

vellaveto-proxy --protect fortress -- python -m mcp_server

Custom Config

vellaveto-proxy --config policy.toml -- /path/to/mcp-server

SDKs

References

• MCP Specification 2025-11-25
• OWASP Top 10 for Agentic Applications 2026
• OWASP Top 10 for MCP Servers
• CoSAI MCP Security Whitepaper
• ETDI: Mitigating Tool Squatting and Rug Pull Attacks in MCP
• Enterprise-Grade Security for MCP
• MCP Security Vulnerabilities — Practical DevSecOps

Use with VS Code (Copilot / Cline / Roo Code)

Add to your VS Code settings.json:

{
  "mcp": {
    "servers": {
      "filesystem": {
        "command": "vellaveto-proxy",
        "args": [
          "--protect", "fortress",
          "--", "npx", "-y",
          "@modelcontextprotocol/server-filesystem", "."
        ]
      }
    }
  }
}

See docs/QUICKSTART.md for more providers (Zed, JetBrains, Amazon Q, Continue) and SDK integration guides (Anthropic, OpenAI, LangChain, LangGraph, CrewAI).

How It Compares

Trade-offs: AgentGateway and MCP-Scan have strong institutional backing (Linux Foundation, Snyk) and larger communities. AgentGateway excels as a connectivity and observability layer with external policy engine integration (OPA, OpenFGA); MCP-Scan excels at scanning MCP server configurations and now includes a runtime proxy mode. Both have solid security features. Lasso Gateway and PipeLock (Go, single binary) are closer in scope but lighter on depth. VellaVeto differentiates as a runtime boundary enforcer: integrated policy evaluation (<5ms P99), structured ACIS decision envelopes on every verdict, multi-transport parity, session isolation as a product invariant, compliance evidence, and formal verification of boundary properties. The table above is our honest best-effort comparison — we encourage you to evaluate each tool against your own requirements.