Anthropic's Model Context Protocol (MCP) has quickly become the standard for connecting LLMs to local files, tools, and APIs. It is a fantastic protocol, but it has a major architectural blind spot that most developers are ignoring.
The stdio Transport Vulnerability
Most desktop MCP integrations (like Cursor or Claude Desktop) communicate with server backends via standard input and output (stdio) transport. The host client launches the MCP server as a local subprocess and pipes JSON-RPC messages back and forth.
This is convenient, but it bypasses the network stack. Your traditional network gateways, corporate firewalls, and API firewalls see absolutely zero of this traffic.
If an AI agent gets hit with a prompt injection attack, the attacker can trick a filesystem MCP server into reading sensitive local files like ~/.ssh/id_rsa or .env configurations. Since the subprocess inherits your user account privileges, the operating system allows it. The exfiltration happens silently.
How AegisMCP wraps the server process and contains resource access at the kernel layer.
Introducing AegisMCP
To secure local tool execution, we built and open sourced AegisMCP: a lightweight, OS native sandboxing proxy written in Rust.
Instead of spawning your MCP server directly, you wrap it with AegisMCP. It dynamically configures strict, process level restrictions using the host operating system's native security frameworks:
- Apple Seatbelt (via sandbox-exec) on macOS to enforce filesystem and outbound network jailing.
- Landlock LSM on Linux to restrict filesystem paths at the directory tree level.
Syscall Level Blocking
AegisMCP parses incoming and outgoing JSON-RPC streams in user space for audit logging. However, the actual security enforcement happens at the OS kernel level.
If a prompt injected agent attempts to read an unauthorized directory, the kernel intercepts the system call and returns an instant EPERM (Operation not permitted) error. The MCP server process physically cannot access the files or transmit them over the network.
Get AegisMCP
We have open sourced the codebase and written a comprehensive end to end verification test proving the mitigation.
- 📦 GitHub Repository — Inspect the code and try the demo
- 📄 Getting Started Guide — Wrap your own Cursor/Claude local tools today