langprotect-mcp-gateway 1.2.5__tar.gz → 1.3.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/PKG-INFO +97 -81
  2. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/README.md +96 -80
  3. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/langprotect_mcp_gateway/gateway.py +322 -21
  4. langprotect_mcp_gateway-1.3.0/langprotect_mcp_gateway/response_masker.py +323 -0
  5. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/langprotect_mcp_gateway.egg-info/PKG-INFO +97 -81
  6. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/langprotect_mcp_gateway.egg-info/SOURCES.txt +3 -1
  7. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/pyproject.toml +1 -1
  8. langprotect_mcp_gateway-1.3.0/tests/test_response_masker.py +272 -0
  9. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/LICENSE +0 -0
  10. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/langprotect_mcp_gateway/__init__.py +0 -0
  11. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/langprotect_mcp_gateway/setup_helper.py +0 -0
  12. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/langprotect_mcp_gateway.egg-info/dependency_links.txt +0 -0
  13. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/langprotect_mcp_gateway.egg-info/entry_points.txt +0 -0
  14. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/langprotect_mcp_gateway.egg-info/requires.txt +0 -0
  15. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/langprotect_mcp_gateway.egg-info/top_level.txt +0 -0
  16. {langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/setup.cfg +0 -0
{langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: langprotect-mcp-gateway
3
- Version: 1.2.5
3
+ Version: 1.3.0
4
4
  Summary: Security gateway for Model Context Protocol (MCP) to protect AI tool interactions
5
5
  Author-email: LangProtect Security Team <security@langprotect.com>
6
6
  License: MIT
@@ -32,134 +32,150 @@ Dynamic: license-file
32
32
 
33
33
  [![PyPI version](https://badge.fury.io/py/langprotect-mcp-gateway.svg)](https://pypi.org/project/langprotect-mcp-gateway/)
34
34
 
35
- ## Features
36
-
37
- ✅ **Automatic Threat Detection** - Scans all MCP requests for security risks
38
- ✅ **Access Control** - Whitelist/blacklist MCP servers and tools
39
- ✅ **Full Audit Trail** - Logs all AI interactions for compliance
40
- ✅ **IDE Support** - Works with VS Code, Cursor, and all MCP-compatible IDEs
41
- ✅ **Easy Setup** - 30-second installation
42
- ✅ **Fail-Open Design** - Won't block your workflow if backend is unavailable
43
-
44
- ## Quick Start
35
+ ## 🆕 What's New in v1.3.0
45
36
 
46
- ### Installation
37
+ ### Layer 2: Output Scanning 🔍
38
+ - **Automatic secret masking** in AI-generated responses
39
+ - **30+ secret types detected**: AWS, Google Cloud, Azure, Stripe, GitHub, JWTs, DB credentials, private keys
40
+ - **Non-blocking warnings** - never interrupts workflow
41
+ - **Preserves structure** - masks secrets while keeping code/content readable
47
42
 
48
- The gateway runs as a global CLI tool. Choose your platform:
43
+ ### Enhanced Security Controls 🔐
44
+ - **Fail-closed mode** - Block requests on scan failures (optional)
45
+ - **Configurable timeouts** - Control scan performance
46
+ - **High-entropy detection** - Catch unknown secret formats
49
47
 
50
- #### Linux (Debian/Ubuntu) - Recommended: pipx
48
+ ### Example
51
49
 
50
+ **Before** (v1.2.6):
52
51
  ```bash
53
- # Install pipx (one time)
54
- sudo apt install pipx -y
55
- pipx ensurepath
52
+ AI: Here's your AWS deployment script:
53
+ export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
54
+ export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG..."
55
+ ```
56
56
 
57
- # Install the gateway
58
- pipx install langprotect-mcp-gateway
57
+ **After** (v1.3.0):
58
+ ```bash
59
+ AI: Here's your AWS deployment script:
60
+ export AWS_ACCESS_KEY_ID="<REDACTED:AWS_ACCESS_KEY:1a5d44a2>"
61
+ export AWS_SECRET_ACCESS_KEY="<REDACTED:AWS_SECRET_KEY:73ec276f>"
59
62
  ```
63
+ ✅ **Secrets masked** | 🔒 **Code structure preserved** | 📝 **Audit trail maintained**
60
64
 
61
- #### macOS - Recommended: pipx
65
+ ---
62
66
 
63
- ```bash
64
- # Install pipx via Homebrew
65
- brew install pipx
66
- pipx ensurepath
67
+ ## Features
67
68
 
68
- # Install the gateway
69
- pipx install langprotect-mcp-gateway
70
- ```
69
+ ✅ **Two-Layer Protection**
70
+ - **Layer 1 (Input)**: Blocks dangerous requests before sending to MCP server
71
+ - **Layer 2 (Output)**: Masks secrets in AI responses
71
72
 
72
- #### Windows
73
+ ✅ **Automatic Threat Detection** - Scans all MCP requests for security risks
74
+ ✅ **Access Control** - Whitelist/blacklist MCP servers and tools
75
+ ✅ **Full Audit Trail** - Logs all AI interactions for compliance
76
+ ✅ **IDE Support** - Works with VS Code, Cursor, and all MCP-compatible IDEs
77
+ ✅ **Easy Setup** - 30-second installation
78
+ ✅ **Fail-Open Design** - Won't block your workflow if backend is unavailable
73
79
 
74
- ```bash
75
- # Option 1: pipx (recommended)
76
- pip install pipx
77
- pipx install langprotect-mcp-gateway
80
+ ## Quick Start
78
81
 
79
- # Option 2: User install
80
- pip install --user langprotect-mcp-gateway
81
- ```
82
+ ### 1. Installation
82
83
 
83
- #### Verify Installation
84
+ The gateway runs as a global CLI tool. We recommend using `pipx` to manage the installation.
84
85
 
85
86
  ```bash
86
- which langprotect-gateway # Should show: ~/.local/bin/langprotect-gateway
87
- langprotect-gateway --help # Should show usage info
87
+ # Recommended: Install via pipx
88
+ pipx install langprotect-mcp-gateway
88
89
  ```
89
90
 
90
- #### Automatic Setup (Recommended)
91
+ ### 2. Automatic Setup (Recommended) 🚀
91
92
 
92
- Run the setup command to automatically configure VS Code:
93
+ Run our automated setup command to configure VS Code, Cursor, or Claude Desktop for all workspaces:
93
94
 
94
95
  ```bash
95
96
  langprotect-gateway-setup
96
97
  ```
97
98
 
98
99
  This will:
99
- - ✅ Create a global wrapper script
100
+ - ✅ Create a global wrapper script at `~/.local/bin/langprotect-mcp-wrapper.sh`
100
101
  - ✅ Configure VS Code for global visibility in ALL workspaces
101
- - ✅ Sync with Claude Desktop config for high compatibility
102
- - ✅ Enable auto-start
102
+ - ✅ Enable auto-start for seamless protection
103
+
104
+ ### 3. Configure Your Credentials
103
105
 
104
- Then edit the wrapper script to add your credentials:
106
+ Edit the generated wrapper script to add your LangProtect email and password:
105
107
 
106
108
  ```bash
107
109
  # Linux/macOS
108
110
  nano ~/.local/bin/langprotect-mcp-wrapper.sh
109
111
 
110
112
  # Update these lines:
111
- export LANGPROTECT_URL="http://localhost:8000"
113
+ export LANGPROTECT_URL="https://your-backend.com" # e.g. http://localhost:8000
112
114
  export LANGPROTECT_EMAIL="your.email@company.com"
113
115
  export LANGPROTECT_PASSWORD="your-password"
114
116
  ```
115
117
 
116
- Reload VS Code and you're done! LangProtect will protect all your workspaces.
118
+ Reload VS Code and you're done! LangProtect will now protect all your workspaces.
117
119
 
118
- ### VS Code Setup (Recommended - No Wrapper Script!)
120
+ ---
119
121
 
120
- **Step 1:** Add this to your `.vscode/mcp.json`:
122
+ ## ⚙️ Configuration Options (v1.3.0+)
121
123
 
122
- ```json
123
- {
124
- "servers": {
125
- "langprotect-gateway": {
126
- "type": "stdio",
127
- "command": "langprotect-gateway",
128
- "args": ["--mcp-json-path", "${workspaceFolder}/.vscode/mcp.json"],
129
- "env": {
130
- "LANGPROTECT_URL": "http://localhost:8000",
131
- "LANGPROTECT_EMAIL": "your.email@company.com",
132
- "LANGPROTECT_PASSWORD": "your-password"
133
- },
134
- "servers": {
135
- "filesystem": {
136
- "command": "npx",
137
- "args": ["-y", "@modelcontextprotocol/server-filesystem", "."]
138
- }
139
- }
140
- }
141
- }
142
- }
124
+ Configure security behavior with environment variables in your wrapper script:
125
+
126
+ ```bash
127
+ # Security Controls
128
+ export LANGPROTECT_ENABLE_MASKING=true # Enable output masking (default: true)
129
+ export LANGPROTECT_FAIL_CLOSED=false # Block on scan errors (default: false = fail-open)
130
+ export LANGPROTECT_SCAN_TIMEOUT=5.0 # Scan timeout in seconds (default: 5.0)
131
+ export LANGPROTECT_ENTROPY_DETECTION=true # Detect unknown secrets via entropy (default: true)
132
+
133
+ # Backend Connection
134
+ export LANGPROTECT_URL="http://localhost:8000"
135
+ export LANGPROTECT_EMAIL="your.email@company.com"
136
+ export LANGPROTECT_PASSWORD="your-password"
143
137
  ```
144
138
 
145
- **Step 2 (Optional):** Enable auto-start in `.vscode/settings.json`:
139
+ ### Security Modes
146
140
 
147
- ```json
148
- {
149
- "chat.mcp.autostart": "newAndOutdated"
150
- }
141
+ **Fail-Open (Default)** - Recommended for development:
142
+ ```bash
143
+ export LANGPROTECT_FAIL_CLOSED=false
144
+ ```
145
+ - If scan times out or fails → **Allow request** (log warning)
146
+ - Won't block your workflow
147
+ - Best for development environments
148
+
149
+ **Fail-Closed** - Recommended for production:
150
+ ```bash
151
+ export LANGPROTECT_FAIL_CLOSED=true
152
+ ```
153
+ - If scan times out or fails → **Block request**
154
+ - Maximum security
155
+ - Best for production/sensitive environments
156
+
157
+ ### Output Masking
158
+
159
+ Control how AI-generated secrets are handled:
160
+
161
+ ```bash
162
+ # Enable masking (default)
163
+ export LANGPROTECT_ENABLE_MASKING=true
164
+
165
+ # Disable masking (see secrets in plain text - not recommended)
166
+ export LANGPROTECT_ENABLE_MASKING=false
151
167
  ```
152
168
 
153
- This makes VS Code automatically start the gateway when you open the workspace!
169
+ **Masked format**: `<REDACTED:SECRET_TYPE:hash>`
170
+ - Example: `<REDACTED:AWS_ACCESS_KEY:1a5d44a2>`
171
+ - Hash allows deduplication across logs
172
+ - Preserves code structure
154
173
 
155
- That's it! VS Code will:
156
- 1. Start the gateway with your credentials (automatically if autostart is enabled)
157
- 2. Gateway reads the `servers` section and proxies those MCP servers
158
- 3. All tool calls get logged to LangProtect
174
+ ---
159
175
 
160
- ### Alternative: Wrapper Script Setup
176
+ ## 🏗️ Manual Setup (Per-Workspace)
161
177
 
162
- If you prefer using a wrapper script (useful for shared configs):
178
+ If you prefer to enable LangProtect only for a specific project, you can use a local `.vscode/mcp.json` file.
163
179
 
164
180
  1. Create a wrapper script (e.g., `langprotect-wrapper.sh`):
165
181
 
{langprotect_mcp_gateway-1.2.5 → langprotect_mcp_gateway-1.3.0}/README.md RENAMED
@@ -4,134 +4,150 @@
4
4
 
5
5
  [![PyPI version](https://badge.fury.io/py/langprotect-mcp-gateway.svg)](https://pypi.org/project/langprotect-mcp-gateway/)
6
6
 
7
- ## Features
8
-
9
- ✅ **Automatic Threat Detection** - Scans all MCP requests for security risks
10
- ✅ **Access Control** - Whitelist/blacklist MCP servers and tools
11
- ✅ **Full Audit Trail** - Logs all AI interactions for compliance
12
- ✅ **IDE Support** - Works with VS Code, Cursor, and all MCP-compatible IDEs
13
- ✅ **Easy Setup** - 30-second installation
14
- ✅ **Fail-Open Design** - Won't block your workflow if backend is unavailable
15
-
16
- ## Quick Start
7
+ ## 🆕 What's New in v1.3.0
17
8
 
18
- ### Installation
9
+ ### Layer 2: Output Scanning 🔍
10
+ - **Automatic secret masking** in AI-generated responses
11
+ - **30+ secret types detected**: AWS, Google Cloud, Azure, Stripe, GitHub, JWTs, DB credentials, private keys
12
+ - **Non-blocking warnings** - never interrupts workflow
13
+ - **Preserves structure** - masks secrets while keeping code/content readable
19
14
 
20
- The gateway runs as a global CLI tool. Choose your platform:
15
+ ### Enhanced Security Controls 🔐
16
+ - **Fail-closed mode** - Block requests on scan failures (optional)
17
+ - **Configurable timeouts** - Control scan performance
18
+ - **High-entropy detection** - Catch unknown secret formats
21
19
 
22
- #### Linux (Debian/Ubuntu) - Recommended: pipx
20
+ ### Example
23
21
 
22
+ **Before** (v1.2.6):
24
23
  ```bash
25
- # Install pipx (one time)
26
- sudo apt install pipx -y
27
- pipx ensurepath
24
+ AI: Here's your AWS deployment script:
25
+ export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
26
+ export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG..."
27
+ ```
28
28
 
29
- # Install the gateway
30
- pipx install langprotect-mcp-gateway
29
+ **After** (v1.3.0):
30
+ ```bash
31
+ AI: Here's your AWS deployment script:
32
+ export AWS_ACCESS_KEY_ID="<REDACTED:AWS_ACCESS_KEY:1a5d44a2>"
33
+ export AWS_SECRET_ACCESS_KEY="<REDACTED:AWS_SECRET_KEY:73ec276f>"
31
34
  ```
35
+ ✅ **Secrets masked** | 🔒 **Code structure preserved** | 📝 **Audit trail maintained**
32
36
 
33
- #### macOS - Recommended: pipx
37
+ ---
34
38
 
35
- ```bash
36
- # Install pipx via Homebrew
37
- brew install pipx
38
- pipx ensurepath
39
+ ## Features
39
40
 
40
- # Install the gateway
41
- pipx install langprotect-mcp-gateway
42
- ```
41
+ ✅ **Two-Layer Protection**
42
+ - **Layer 1 (Input)**: Blocks dangerous requests before sending to MCP server
43
+ - **Layer 2 (Output)**: Masks secrets in AI responses
43
44
 
44
- #### Windows
45
+ ✅ **Automatic Threat Detection** - Scans all MCP requests for security risks
46
+ ✅ **Access Control** - Whitelist/blacklist MCP servers and tools
47
+ ✅ **Full Audit Trail** - Logs all AI interactions for compliance
48
+ ✅ **IDE Support** - Works with VS Code, Cursor, and all MCP-compatible IDEs
49
+ ✅ **Easy Setup** - 30-second installation
50
+ ✅ **Fail-Open Design** - Won't block your workflow if backend is unavailable
45
51
 
46
- ```bash
47
- # Option 1: pipx (recommended)
48
- pip install pipx
49
- pipx install langprotect-mcp-gateway
52
+ ## Quick Start
50
53
 
51
- # Option 2: User install
52
- pip install --user langprotect-mcp-gateway
53
- ```
54
+ ### 1. Installation
54
55
 
55
- #### Verify Installation
56
+ The gateway runs as a global CLI tool. We recommend using `pipx` to manage the installation.
56
57
 
57
58
  ```bash
58
- which langprotect-gateway # Should show: ~/.local/bin/langprotect-gateway
59
- langprotect-gateway --help # Should show usage info
59
+ # Recommended: Install via pipx
60
+ pipx install langprotect-mcp-gateway
60
61
  ```
61
62
 
62
- #### Automatic Setup (Recommended)
63
+ ### 2. Automatic Setup (Recommended) 🚀
63
64
 
64
- Run the setup command to automatically configure VS Code:
65
+ Run our automated setup command to configure VS Code, Cursor, or Claude Desktop for all workspaces:
65
66
 
66
67
  ```bash
67
68
  langprotect-gateway-setup
68
69
  ```
69
70
 
70
71
  This will:
71
- - ✅ Create a global wrapper script
72
+ - ✅ Create a global wrapper script at `~/.local/bin/langprotect-mcp-wrapper.sh`
72
73
  - ✅ Configure VS Code for global visibility in ALL workspaces
73
- - ✅ Sync with Claude Desktop config for high compatibility
74
- - ✅ Enable auto-start
74
+ - ✅ Enable auto-start for seamless protection
75
+
76
+ ### 3. Configure Your Credentials
75
77
 
76
- Then edit the wrapper script to add your credentials:
78
+ Edit the generated wrapper script to add your LangProtect email and password:
77
79
 
78
80
  ```bash
79
81
  # Linux/macOS
80
82
  nano ~/.local/bin/langprotect-mcp-wrapper.sh
81
83
 
82
84
  # Update these lines:
83
- export LANGPROTECT_URL="http://localhost:8000"
85
+ export LANGPROTECT_URL="https://your-backend.com" # e.g. http://localhost:8000
84
86
  export LANGPROTECT_EMAIL="your.email@company.com"
85
87
  export LANGPROTECT_PASSWORD="your-password"
86
88
  ```
87
89
 
88
- Reload VS Code and you're done! LangProtect will protect all your workspaces.
90
+ Reload VS Code and you're done! LangProtect will now protect all your workspaces.
89
91
 
90
- ### VS Code Setup (Recommended - No Wrapper Script!)
92
+ ---
91
93
 
92
- **Step 1:** Add this to your `.vscode/mcp.json`:
94
+ ## ⚙️ Configuration Options (v1.3.0+)
93
95
 
94
- ```json
95
- {
96
- "servers": {
97
- "langprotect-gateway": {
98
- "type": "stdio",
99
- "command": "langprotect-gateway",
100
- "args": ["--mcp-json-path", "${workspaceFolder}/.vscode/mcp.json"],
101
- "env": {
102
- "LANGPROTECT_URL": "http://localhost:8000",
103
- "LANGPROTECT_EMAIL": "your.email@company.com",
104
- "LANGPROTECT_PASSWORD": "your-password"
105
- },
106
- "servers": {
107
- "filesystem": {
108
- "command": "npx",
109
- "args": ["-y", "@modelcontextprotocol/server-filesystem", "."]
110
- }
111
- }
112
- }
113
- }
114
- }
96
+ Configure security behavior with environment variables in your wrapper script:
97
+
98
+ ```bash
99
+ # Security Controls
100
+ export LANGPROTECT_ENABLE_MASKING=true # Enable output masking (default: true)
101
+ export LANGPROTECT_FAIL_CLOSED=false # Block on scan errors (default: false = fail-open)
102
+ export LANGPROTECT_SCAN_TIMEOUT=5.0 # Scan timeout in seconds (default: 5.0)
103
+ export LANGPROTECT_ENTROPY_DETECTION=true # Detect unknown secrets via entropy (default: true)
104
+
105
+ # Backend Connection
106
+ export LANGPROTECT_URL="http://localhost:8000"
107
+ export LANGPROTECT_EMAIL="your.email@company.com"
108
+ export LANGPROTECT_PASSWORD="your-password"
115
109
  ```
116
110
 
117
- **Step 2 (Optional):** Enable auto-start in `.vscode/settings.json`:
111
+ ### Security Modes
118
112
 
119
- ```json
120
- {
121
- "chat.mcp.autostart": "newAndOutdated"
122
- }
113
+ **Fail-Open (Default)** - Recommended for development:
114
+ ```bash
115
+ export LANGPROTECT_FAIL_CLOSED=false
116
+ ```
117
+ - If scan times out or fails → **Allow request** (log warning)
118
+ - Won't block your workflow
119
+ - Best for development environments
120
+
121
+ **Fail-Closed** - Recommended for production:
122
+ ```bash
123
+ export LANGPROTECT_FAIL_CLOSED=true
124
+ ```
125
+ - If scan times out or fails → **Block request**
126
+ - Maximum security
127
+ - Best for production/sensitive environments
128
+
129
+ ### Output Masking
130
+
131
+ Control how AI-generated secrets are handled:
132
+
133
+ ```bash
134
+ # Enable masking (default)
135
+ export LANGPROTECT_ENABLE_MASKING=true
136
+
137
+ # Disable masking (see secrets in plain text - not recommended)
138
+ export LANGPROTECT_ENABLE_MASKING=false
123
139
  ```
124
140
 
125
- This makes VS Code automatically start the gateway when you open the workspace!
141
+ **Masked format**: `<REDACTED:SECRET_TYPE:hash>`
142
+ - Example: `<REDACTED:AWS_ACCESS_KEY:1a5d44a2>`
143
+ - Hash allows deduplication across logs
144
+ - Preserves code structure
126
145
 
127
- That's it! VS Code will:
128
- 1. Start the gateway with your credentials (automatically if autostart is enabled)
129
- 2. Gateway reads the `servers` section and proxies those MCP servers
130
- 3. All tool calls get logged to LangProtect
146
+ ---
131
147
 
132
- ### Alternative: Wrapper Script Setup
148
+ ## 🏗️ Manual Setup (Per-Workspace)
133
149
 
134
- If you prefer using a wrapper script (useful for shared configs):
150
+ If you prefer to enable LangProtect only for a specific project, you can use a local `.vscode/mcp.json` file.
135
151
 
136
152
  1. Create a wrapper script (e.g., `langprotect-wrapper.sh`):
137
153