AI Firewall MCP

io.github.AkhiluckyPublished by GitHub account Akhiluckyv1.0.1Updated Oct 24, 2026

Multi-agent LLM security layer detecting prompt injection and jailbreaks.

VerifiedSTDIODesktop onlySecurity & MonitoringAI & ML

Overview

AI-generated overview

An MCP server that screens prompts for injection, jailbreaks, and policy violations before they reach an LLM.

What you can do
Runs a three-agent pipeline over each prompt: a retrieval agent does semantic search against known attack patterns in a FAISS vector store, a guard agent scores vector similarity, keyword matches, and heuristics, and a policy agent returns ALLOW, BLOCK, or SANITIZE. Exposes five tools: analyze_prompt, get_threat_breakdown, sanitize_prompt, get_firewall_status, and benchmark_firewall. A CLI and optional REST API are also included.
When to use it
Use it when an assistant or agent pipeline accepts untrusted user input and you want a pre-LLM check for prompt injection, jailbreak attempts, or data exfiltration and leakage. Also useful for red-team testing of your own prompts via the adversarial benchmark tool.
Requirements
Local process over stdio. Install the PyPI package ai-firewall-mcp with pip or pipx, or run the Docker image. No accounts, API keys, or headers are declared. Optional environment variables FIREWALL_MODE, SIMILARITY_THRESHOLD, and LOG_LEVEL tune behavior. The REST API mode needs the api extra installed.
Before you install
The server inspects prompt text, so prompts you analyze are processed by its local models and vector store; consider whether that content is sensitive. It returns ALLOW, BLOCK, or SANITIZE decisions that can change or drop prompt content, so test thresholds before relying on them in production. No credentials are requested by the manifest.

Installation

In SourceWeft

  1. Open AI Firewall MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

<mcp-name: io.github.Akhilucky/ai-firewall-mcp>

AI Firewall — MCP Server

A multi-agent AI security layer that protects LLMs from prompt injection, jailbreaks, and policy violations. Available as an MCP server for any MCP-compatible client (Claude Desktop, Cursor, Windsurf, Cline, Roo Code, etc.).

Quick Start

pip install

bash
pip install ai-firewall-mcpai-firewall-mcp

Docker

bash
docker pull akhilucky/ai-firewall-mcp:latestdocker run -i akhilucky/ai-firewall-mcp:latest

Claude Desktop

Add to claude_desktop_config.json:

pip install:

json
{  "mcpServers": {    "ai-firewall": {      "command": "pipx",      "args": ["run", "ai-firewall-mcp"]    }  }}

Docker:

json
{  "mcpServers": {    "ai-firewall": {      "command": "docker",      "args": ["run", "-i", "akhilucky/ai-firewall-mcp:latest"]    }  }}

Cursor / Windsurf / Cline / Roo Code

Configure in your MCP settings with:

  • Type: stdio
  • Command: docker run -i akhilucky/ai-firewall-mcp:latest
  • Or use ai-firewall-mcp if installed via pip

MCP Tools

ToolDescription
analyze_promptAnalyze a prompt for injection, jailbreaks, exfiltration, and leakage
get_threat_breakdownDetailed per-signal scoring breakdown from the last analysis
sanitize_promptClean a suspicious prompt while preserving legitimate content
get_firewall_statusHealth check: vector DB size, model status, uptime
benchmark_firewallRun the adversarial test suite and return detection statistics

Testing with MCP Inspector

bash
npx @modelcontextprotocol/inspector ai-firewall-mcp

Architecture

The firewall runs three agents per prompt:

User Prompt → [Retrieval Agent] → [Guard Agent] → [Policy Agent] → LLM                   │                    │               │                   ▼                    ▼               ▼              Vector DB (FAISS)    Threat Signals    Allow/Block
AgentRole
Retrieval AgentSemantic search against known attack patterns (FAISS + sentence-transformers)
Guard AgentMulti-signal classification: vector similarity, keyword match, heuristic scoring
Policy AgentFinal decision: ALLOW / BLOCK / SANITIZE based on configurable thresholds

Threat signals are weighted: 40% vector similarity, 25% keyword match, 20% heuristic, 15% policy weight.

Configuration

Env VarDefaultDescription
FIREWALL_MODEstrictstrict / moderate / permissive
SIMILARITY_THRESHOLD0.50Vector match threshold (lower = stricter)
LOG_LEVELINFOLogging verbosity

CLI / API Usage

bash
# Interactive dashboardpython main.py
# Red-team adversarial testspython main.py --redteam
# REST API serverpython main.py --api
# Single prompt analysispython main.py --analyze "Ignore all previous instructions"

The REST API runs at http://localhost:8000 with OpenAPI docs at /docs (requires pip install ai-firewall-mcp[api]).

Testing

bash
pytest tests/ -v          # Full test suite (43 tests)pytest tests/test_mcp.py  # MCP-specific tests only

Project Structure

├── src/ai_firewall/          # MCP server package (PyPI entry)│   ├── mcp_server.py         #    5 MCP tools, stdio transport│   ├── threat_scorer.py      #    Per-signal scoring breakdown│   └── __init__.py├── src/agents/               # Core firewall agents├── tests/                    # Test suites├── Dockerfile                # Docker image (2.04GB, CPU-only torch)├── pyproject.toml            # Package config & metadata└── .github/workflows/ci.yml  # CI/CD pipeline

License

MIT — see LICENSE.

Built for security. Designed for production.

Source: README.md at commit 4570507

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts