mcp-bastion-python 1.0.16__tar.gz → 1.0.17__tar.gz

{mcp_bastion_python-1.0.16 → mcp_bastion_python-1.0.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-bastion-python
-Version: 1.0.16
+Version: 1.0.17
 Summary: Security middleware for MCP servers protecting LLM agents from prompt injection, resource exhaustion, and PII leakage
 Project-URL: Homepage, https://github.com/mcp-bastion/mcp-bastion
 Project-URL: Repository, https://github.com/mcp-bastion/mcp-bastion
@@ -97,41 +97,186 @@ Provides-Extra: policy
 Requires-Dist: pyyaml>=6.0; extra == 'policy'
 Description-Content-Type: text/markdown
 
-<p align="center">
-  <img src="images/mcp-bastian.png" alt="MCP-Bastion" width="520" />
-</p>
-
 # MCP-Bastion
 
 <!-- mcp-name: io.github.vaquarkhan/mcp-bastion -->
 
-[![Total Downloads](https://img.shields.io/badge/total%20downloads-3.4K-brightgreen)](https://pepy.tech/projects/mcp-bastion-python)
+<p align="center">
+  <img
+    src="images/mcp-bastian.png"
+    alt="MCP-Bastion — Fortifying the Model Context Protocol"
+    width="720"
+    style="max-width:100%; height:auto;"
+  />
+</p>
 
-[![PyPI Version](https://img.shields.io/pypi/v/mcp-bastion-python)](https://pypi.org/project/mcp-bastion-python/)
-[![PyPI downloads](https://img.shields.io/pepy/dt/mcp-bastion-python)](https://pepy.tech/projects/mcp-bastion-python)
+[![PyPI: mcp-bastion-python 1.0.17](https://img.shields.io/pypi/v/mcp-bastion-python?logo=python)](https://pypi.org/project/mcp-bastion-python/1.0.17/)
+[![PePy all-time downloads (mcp-bastion-python)](https://img.shields.io/pepy/dt/mcp-bastion-python?label=PePy%20all-time%20downloads)](https://pepy.tech/projects/mcp-bastion-python)
 [![Python](https://img.shields.io/pypi/pyversions/mcp-bastion-python)](https://pypi.org/project/mcp-bastion-python/)
 [![CI](https://img.shields.io/github/actions/workflow/status/vaquarkhan/MCP-Bastion/ci.yml?branch=main&label=CI)](https://github.com/vaquarkhan/MCP-Bastion/actions/workflows/ci.yml)
+[![Docker: GHCR mcp-bastion-proxy (port 8080)](https://img.shields.io/badge/docker%20%28ghcr%29-mcp--bastion--proxy%20%7C%208080-2496ED?logo=docker)](https://github.com/vaquarkhan/MCP-Bastion/pkgs/container/mcp-bastion-proxy)
+[![Docker: GHCR mcp-bastion-dashboard (port 7000)](https://img.shields.io/badge/docker%20%28ghcr%29-mcp--bastion--dashboard%20%7C%207000-2496ED?logo=docker)](https://github.com/vaquarkhan/MCP-Bastion/pkgs/container/mcp-bastion-dashboard)
 [![License: Source Available](https://img.shields.io/badge/license-Source%20Available-orange.svg)](LICENSE)
+[![Website](https://img.shields.io/badge/website-vaquarkhan.github.io/MCP--Bastion-blue?logo=github)](https://vaquarkhan.github.io/MCP-Bastion/)
+
+**The security layer MCP servers are missing.** Your agent can call databases, APIs, and shell tools. One bad prompt can leak PII; one runaway loop can burn your API budget in minutes. MCP-Bastion wraps your MCP server with **local** guardrails: injection blocking, PII redaction, and **denial-of-wallet caps** (iteration limits, token budget, optional USD ceilings), under **5ms overhead**, with no third-party safety API.
+
+### Why developers adopt it
+
+| You need… | MCP-Bastion gives you… |
+|-----------|-------------------------|
+| **Guardrails without a rewrite** | Drop-in middleware: `secure_fastmcp(mcp)` or one `bastion.yaml` |
+| **Privacy your legal team accepts** | PromptGuard + Presidio run **in your process**; data stays on your network |
+| **Stop runaway agents & budget burn** | **On by default:** 15 tool calls/session, 60s timeout, 50k token budget. **Optional:** per-tool caps, USD session/day limits, response offload |
+| **Shrink context & cut token spend** | **Opt-in:** discovery filter (fewer tools in `tools/list`), output budget + session offload, semantic cache — less context in every turn |
+| **Something that ships today** | PyPI, npm, Docker on GHCR, FastMCP, TypeScript wrapper, CI validate, live dashboard |
+| **Policy your team can review** | `bastion.yaml` in Git, hot reload, OWASP-aligned controls ([docs/PILLARS.md](docs/PILLARS.md)) |
+
+### FinOps & abuse protection (denial-of-wallet)
+
+Agents can loop on expensive tools (search, LLM calls, paid APIs) until your bill spikes. Bastion enforces **session-level FinOps at the MCP boundary** before each `tools/call`:
+
+| Attack pattern | What Bastion does | Default |
+|----------------|---------------------|---------|
+| **Infinite tool loop** | Blocks after max iterations per session | **On** (15 calls) |
+| **Long-running session abuse** | Session timeout | **On** (60s) |
+| **Token / context budget burn** | Token budget per session; optional output offload | **On** (50k tokens); offload opt-in |
+| **Same tool hammered** | Per-tool call cap (`max_per_tool`) | Opt-in |
+| **Paid API spend runaway** | USD caps via cost tracker | Opt-in |
+| **Flaky or hostile tool cascade** | Circuit breaker opens after failures | Opt-in in example config |
+| **Tool sprawl in one session** | Cap distinct tools per session | Opt-in |
+
+Blocked calls return standard errors (`RateLimitExceededError` **-32002**, `TokenBudgetExceededError` **-32003**, `CostBudgetExceededError` **-32009**) and show up in the dashboard and audit log. See [docs/ATTACK_PREVENTION.md](docs/ATTACK_PREVENTION.md#3-rate-exhaustion--denial-of-wallet).
+
+### Token reduction & cost saving
+
+Bastion does not only **block** runaway spend — it **reduces** how many tokens reach the model on every turn:
+
+| Savings lever | What it does | Default |
+|---------------|--------------|---------|
+| **Discovery filter** | Hides unused tools from `tools/list` so agents carry a smaller tool catalog in context | Opt-in |
+| **Output budget + offload** | Truncates oversized tool responses; stores the rest in-session for `bastion_get_offloaded` | Opt-in |
+| **Semantic cache** | Skips redundant tool calls when inputs match a prior result | Opt-in |
+| **Token budget caps** | Hard stop before session token burn exceeds your limit | **On** (50k tokens) |
+| **USD session/day limits** | Dollar ceilings via cost tracker | Opt-in |
+
+Less context per turn means lower LLM input cost — without sending prompts to a third-party optimizer API.
+
+**Bottom line:** MCP turned every server into an agent gateway overnight. Bastion is the firewall that makes that gateway safe to run in production — in **three lines of code** or one config file.
+
+### OWASP MCP Top 10 + production attacks
+
+All **10** [OWASP MCP Top 10](https://owasp.org/www-project-mcp-top-10/) risks are mitigated at the MCP boundary (see controls below). Bastion also blocks **FinOps and abuse** patterns that OWASP does not list separately.
+
+<p align="center">
+  <img
+    src="images/mcp-bastion-owasp-coverage.png"
+    alt="MCP-Bastion: OWASP MCP Top 10, FinOps abuse attacks, token reduction and cost saving, 16 security pillars"
+    width="960"
+    style="max-width:100%; height:auto; border-radius:12px; border:1px solid #1e293b;"
+  />
+</p>
+
+**OWASP MCP Top 10** (all addressed)
+
+| ID | Risk | Bastion controls |
+|----|------|------------------|
+| MCP01 | Token / secret exposure | PII redaction, audit trail, outbound response scan |
+| MCP02 | Privilege escalation | RBAC, rate limits, cost caps, session tool scope |
+| MCP03 | Tool poisoning | Prompt guard, content filter, response scan, metadata guard, grounding guard |
+| MCP04 | Supply chain | Circuit breaker, `doctor` CLI, audit, observability |
+| MCP05 | Command injection | Prompt guard, content filter, schema validation |
+| MCP06 | Intent subversion | Rate limits, replay guard, per-tool caps, semantic firewall |
+| MCP07 | Weak authentication | RBAC, edge auth |
+| MCP08 | Audit & telemetry | Audit log, dashboard, Prometheus, OTEL, alerts |
+| MCP09 | Shadow MCP servers | Central `bastion.yaml` policy, metrics, discovery filter |
+| MCP10 | Context injection | PII redaction, response scan, output budget, discovery filter |
+
+**FinOps & abuse attacks (beyond OWASP)**
+
+| Attack | Controls |
+|--------|----------|
+| Denial of wallet | Iteration cap, token budget, cost tracker, output budget |
+| Runaway tool loops | Session timeout, rate limiter, circuit breaker |
+| Per-tool hammering | `max_per_tool` session caps |
+| API spend runaway | USD session/day caps |
+| Session tool sprawl | Distinct-tool limit per session |
+| Replay abuse | Replay guard + nonces |
+
+**Token reduction & cost saving**
+
+| Lever | Controls |
+|-------|----------|
+| Smaller tool catalog in context | Discovery filter on `tools/list` |
+| Less output in every turn | Output budget, session offload, `bastion_get_offloaded` |
+| Fewer redundant calls | Semantic cache |
+| Predictable spend | Token budget caps, USD session/day limits |
+
+Deep-dive mapping and integration hooks: [docs/SECURITY_OBSERVABILITY.md](docs/SECURITY_OBSERVABILITY.md) · [docs/ATTACK_PREVENTION.md](docs/ATTACK_PREVENTION.md)
+
+### Secure your MCP server in 3 lines (FastMCP)
+
+```bash
+pip install mcp mcp-bastion-fastmcp
+```
 
-**Enterprise-Grade Security Middleware for the Model Context Protocol**
+```python
+from mcp.server.fastmcp import FastMCP
+from mcp_bastion_fastmcp import secure_fastmcp
+
+mcp = FastMCP("My Server")
+secure_fastmcp(mcp)  # wires prompt guard, PII redaction, rate limits into tools/call
+```
 
-> Releases are published to npm and PyPI via GitHub Actions on tag push.
+**Policy-as-code instead?** Copy `bastion.yaml.example` → `bastion.yaml`, then `pip install mcp-bastion-python[policy]`:
 
-**Documentation:** structured paths for **policy** and **LLM integration** live in [docs/README.md](docs/README.md) and [docs/index.md](docs/index.md). **Community:** open a GitHub **Issue** for bugs or gaps, a **Discussion** for integration questions (if enabled on the repo), or a **PR** for docs and examples—those help every adopter.
+```python
+from mcp_bastion import build_middleware_from_config
 
-**Hello world (minimal Bastion on code):** see **[docs/QUICK_START.md](docs/QUICK_START.md)** — FastMCP helper `secure_fastmcp(mcp)` (wires `MCPBastionMiddleware` into tool dispatch), or two-line `build_middleware_from_config()` for full `bastion.yaml` policy, plus a **CI validate** snippet for pipeline-driven installs.
+middleware = build_middleware_from_config()  # loads bastion.yaml
+```
 
-The Model Context Protocol (MCP) has rapidly become the universally accepted standard for connecting AI agents to enterprise databases and APIs. However, this connectivity introduces a massive new attack surface: unpredictable, non-deterministic agentic behavior.
+More paths (TypeScript, CI validate, Docker): **[docs/QUICK_START.md](docs/QUICK_START.md)** · **[docs/README.md](docs/README.md)** · **[website](https://vaquarkhan.github.io/MCP-Bastion/)**
 
-MCP-Bastion is a lightweight, drop-in security middleware designed to wrap around any existing Python or TypeScript MCP server. Instead of relying on passive logging, human-in-the-loop approvals, or third-party APIs, MCP-Bastion provides an active, 100% local defense layer. It intercepts standard JSON-RPC traffic to stop threats before they cross the enterprise boundary.
+- **Prompt injection defense:** Meta PromptGuard blocks adversarial payloads locally.
+- **PII redaction:** Presidio masks SSN, email, phone in outbound content.
+- **Denial-of-wallet protection:** Token buckets, iteration caps, token budget, cost tracking.
+- **Response scan:** Blocks jailbreak patterns in outbound tool/resource text.
+- **Output budget & grounding guard:** Optional response truncation and path verification (opt-in).
 
-Under 5ms proxy overhead. MCP-Bastion provides:
+### How it works
 
-- **Prompt Injection Defense:** Meta PromptGuard runs locally to block adversarial payloads and jailbreaks.
-- **PII Redaction:** Uses Microsoft Presidio to detect and mask PII before it reaches the LLM context.
-- **Infinite Loop Protection:** Token buckets and cycle detection stop runaway agents from burning API budget.
+MCP-Bastion sits **in-process** on your MCP server and inspects every `tools/call` before it reaches databases, APIs, or shell tools — then redacts sensitive data on the way back.
 
-Secure your MCP server without changing business logic.
+```mermaid
+flowchart LR
+  Agent["AI agent / LLM client"]
+  Server["Your MCP server"]
+  Bastion["MCP-Bastion<br/>middleware"]
+  Tools["Tools & upstream APIs"]
+
+  Agent -->|"JSON-RPC"| Server
+  Server --> Bastion
+  Bastion -->|"✓ allow / ✗ block"| Tools
+  Tools -->|"raw result"| Bastion
+  Bastion -->|"PII masked · audited"| Server
+  Server --> Agent
+```
+
+### Three ways to adopt
+
+```mermaid
+flowchart TB
+  Start(["Protect my MCP server"])
+  Start --> FastMCP["FastMCP · Python<br/><code>secure_fastmcp(mcp)</code>"]
+  Start --> Policy["Policy-as-code<br/><code>build_middleware_from_config()</code>"]
+  Start --> TS["TypeScript<br/><code>wrapWithMcpBastion(server)</code>"]
+  FastMCP --> Docs["docs/QUICK_START.md · path A"]
+  Policy --> Yaml["bastion.yaml + CI validate"]
+  TS --> Sidecar["Rate limit in-process · ML via sidecar"]
+```
+
+> **Releases:** npm, PyPI, and prebuilt **Docker** on GHCR — see [DOCKER.md](DOCKER.md). **Community:** GitHub **Issues**, **Discussions**, **PRs**. **Security:** [SECURITY.md](SECURITY.md).
 
 ---
 
@@ -163,7 +308,7 @@ Hooks into MCP SDKs (TypeScript, Python) and FastMCP via standard middleware. No
 
 ### Complete feature catalog
 
-**Pillar definitions:** Security controls, `bastion.yaml` sections, and how they relate to dashboard health rows are documented in [docs/PILLARS.md](docs/PILLARS.md) (canonical reference; avoids ambiguous “total pillar” counts). The same page lists **extended** features restored in 1.0.16+ (semantic firewall, sensitive classifier, external policy, edge auth, tool allowlist, session scope, tool metadata guard, multi-tenant, audit hash chain, pricing hooks, telemetry sinks, **red team** and **doctor** CLIs, etc.).
+**Pillar definitions:** Security controls, `bastion.yaml` sections, and how they relate to dashboard health rows are documented in [docs/PILLARS.md](docs/PILLARS.md) (canonical reference; avoids ambiguous “total pillar” counts). The same page lists **extended** features restored in 1.0.16+ (semantic firewall, sensitive classifier, external policy, edge auth, tool allowlist, session scope, tool metadata guard, multi-tenant, audit hash chain, pricing hooks, telemetry sinks, **red team** and **doctor** CLIs, etc.) and **FinOps/context** pillars in 1.0.17+ (output budget, discovery filter, response scan, grounding guard).
 
 > **Deeper context:** [docs/SECURITY_OBSERVABILITY.md](docs/SECURITY_OBSERVABILITY.md) — **OWASP MCP Top 10** alignment, attack scenarios, and SIEM/log integrations. **Framework add-ons** (LangChain, OpenAI, Bedrock, …) are listed under [Framework Integrations](#framework-integrations) below.
 
@@ -218,6 +363,18 @@ Hooks into MCP SDKs (TypeScript, Python) and FastMCP via standard middleware. No
 
 **🎥 Demo (screen recording):** [Watch on Vimeo](https://vimeo.com/1186084574) — overview of the dashboard and metrics (link opens the player on Vimeo).
 
+<p align="center">
+  <a href="https://vimeo.com/1186084574" title="Watch MCP-Bastion dashboard demo on Vimeo">
+    <img
+      src="docs/images/dashboard.png"
+      alt="MCP-Bastion dashboard — request KPIs, block rate, PII redacted, cost, top tools, and forensics"
+      width="920"
+      style="max-width:100%; height:auto; border-radius:12px; border:1px solid #e2e8f0;"
+    />
+  </a>
+</p>
+<p align="center"><sub>Click the screenshot for the video demo · Seed demo data: <code>mcp-bastion dashboard --demo</code></sub></p>
+
 Run the optional dashboard for a live view of requests, blocked count, PII redacted, cost, top tools, and recent alerts.
 
 ```bash
@@ -232,6 +389,16 @@ mcp-bastion dashboard --port 7000
 | [http://localhost:7000/api/health](http://localhost:7000/api/health) | `{"status": "ok"}` |
 | [http://localhost:7000/metrics](http://localhost:7000/metrics) | Prometheus text format for Grafana/Datadog |
 
+<p align="center">
+  <img
+    src="docs/images/api-metrics.png"
+    alt="Example /api/metrics JSON — requests_total, blocked_total, pii_redacted_total, cost_total, top_tools"
+    width="720"
+    style="max-width:100%; height:auto; border-radius:8px; border:1px solid #e2e8f0;"
+  />
+</p>
+<p align="center"><sub><code>/api/metrics</code> JSON for Grafana, Datadog, or custom pollers</sub></p>
+
 *Dashboard: total requests, blocked count and %, PII redacted, cost; blocked-by-reason bars; top tools; cost by user; recent alerts — open [http://localhost:7000/](http://localhost:7000/) while `mcp-bastion dashboard` is running.*
 
 - **Alerts:** Slack webhook and cost-threshold alerts. See [dashboard/README.md](dashboard/README.md).
@@ -344,7 +511,7 @@ See **[docs/SECURITY_OBSERVABILITY.md](docs/SECURITY_OBSERVABILITY.md)** for the
 <p align="center">
   <img
     src="images/mcp-bastian-features.png"
-    alt="MCP-Bastion features at a glance — pillars, dashboard, and integrations"
+    alt="MCP-Bastion features at a glance"
     width="920"
     style="max-width:100%; height:auto; border-radius:12px;"
   />
@@ -396,7 +563,7 @@ uv add mcp-bastion-python
 # or
 pip install mcp-bastion-python
 # pinned latest
-pip install mcp-bastion-python==1.0.16
+pip install mcp-bastion-python==1.0.17
 ```
 
 **Prerequisites (recommended)**
@@ -527,46 +694,28 @@ See `VALIDATION_CHECKLIST.md` and `SETUP_GUIDE.md`.
 
 ### Python Tutorial: FastMCP Server
 
-FastMCP server with MCP-Bastion.
+FastMCP server with MCP-Bastion via `secure_fastmcp` (patches tool dispatch — see [integrations/mcp-bastion-fastmcp/README.md](integrations/mcp-bastion-fastmcp/README.md)).
 
 **Step 1: Install dependencies**
 
 ```bash
-pip install mcp mcp-bastion-python
+pip install mcp mcp-bastion-fastmcp
 ```
 
 **Step 2: Create your server file** (`server.py`)
 
 ```python
 from mcp.server.fastmcp import FastMCP
-from mcp_bastion import MCPBastionMiddleware, compose_middleware
+from mcp_bastion_fastmcp import secure_fastmcp
 
-# Create the MCP server
 mcp = FastMCP("My Secure Server")
+secure_fastmcp(mcp)  # call right after FastMCP(), before mcp.run()
 
-# Create MCP-Bastion middleware
-# It intercepts tool calls and resource reads before they execute
-bastion = MCPBastionMiddleware(
-    enable_prompt_guard=True,   # Block malicious prompts via PromptGuard
-    enable_pii_redaction=True,  # Mask PII in outgoing content
-    enable_rate_limit=True,     # Cap at 15 iterations, 60s timeout
-)
-
-# Compose middleware chain (pass to your server's middleware config if supported)
-middleware = compose_middleware(bastion)
-
-# Register a tool (protected when middleware is wired into your server)
 @mcp.tool()
 def get_weather(city: str) -> str:
     """Get weather for a city."""
     return f"Weather in {city}: 22C, sunny"
 
-# Resource (PII redacted)
-@mcp.resource("user://profile/{user_id}")
-def get_profile(user_id: str) -> str:
-    """Get user profile. PII redacted."""
-    return f"User {user_id}: John Doe, SSN 123-45-6789, john@example.com"
-
 if __name__ == "__main__":
     mcp.run(transport="streamable-http")
 ```
@@ -577,10 +726,12 @@ if __name__ == "__main__":
 python server.py
 ```
 
-MCP-Bastion:
-- Scans tool args for prompt injection
-- Redacts PII from resource responses
-- Blocks sessions over 15 calls or 60s
+MCP-Bastion (via `secure_fastmcp`):
+- Scans **tool arguments** for prompt injection before execution
+- Redacts PII in **tool results** on the way out
+- Enforces default rate limits (**15** calls per session, **60s** timeout — see `TokenBucketRateLimiter`)
+
+For **full** `bastion.yaml` policy or **resource** (`resources/read`) PII redaction, use the low-level MCP `Server` with `build_middleware_from_config()` — see [docs/QUICK_START.md](docs/QUICK_START.md) path B.
 
 **Alternative: Policy-as-Code**
 
@@ -633,6 +784,7 @@ bastion_no_pii = MCPBastionMiddleware(enable_pii_redaction=False)
 Extend `Middleware` to add logging, metrics, or custom logic:
 
 ```python
+from mcp_bastion import MCPBastionMiddleware
 from mcp_bastion.base import Middleware, MiddlewareContext, compose_middleware
 
 class LoggingMiddleware(Middleware):
@@ -641,6 +793,7 @@ class LoggingMiddleware(Middleware):
         # log method, elapsed, etc.
         return result
 
+bastion = MCPBastionMiddleware()  # or use the configured instance from above
 middleware = compose_middleware(bastion, LoggingMiddleware())
 ```
 
@@ -663,7 +816,6 @@ import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import {
   wrapWithMcpBastion,
-  wrapCallToolHandler,
 } from "@mcp-bastion/core";
 
 const server = new Server({ name: "my-mcp-server", version: "1.0.0" });
@@ -710,7 +862,7 @@ npx tsx server.ts
 For prompt injection and PII redaction, run a Python HTTP service that exposes `/prompt-guard` and `/pii-redact` endpoints (see the Python package for sidecar implementation). Then:
 
 ```bash
-# Start the Python sidecar, then the TypeScript server
+# Start the Python sidecar, then the TypeScript server (sidecarUrl or MCP_BASTION_URL)
 MCP_BASTION_SIDECAR=http://localhost:8000 npx tsx server.ts
 ```
 
@@ -792,6 +944,7 @@ When MCP-Bastion blocks a request, it returns standard MCP/JSON-RPC errors:
 | -32014 | `ToolNotAllowedError` | Tool not on allowlist |
 | -32015 | `SessionScopeExceededError` | Too many distinct tools per session (scope creep) |
 | -32016 | `ToolMetadataPoisoningError` | Tool list / metadata failed safety checks |
+| -32017 | `GroundingViolationError` | Ungrounded file reference in tool output |
 
 ```python
 # Python: exceptions
@@ -812,6 +965,7 @@ from mcp_bastion.errors import (
     ToolNotAllowedError,
     SessionScopeExceededError,
     ToolMetadataPoisoningError,
+    GroundingViolationError,
 )
 import logging
 logger = logging.getLogger(__name__)
@@ -835,6 +989,7 @@ except (
     ToolNotAllowedError,
     SessionScopeExceededError,
     ToolMetadataPoisoningError,
+    GroundingViolationError,
 ) as e:
     logger.warning("blocked: %s", e.to_mcp_error())
 ```
@@ -888,7 +1043,7 @@ npx -y @modelcontextprotocol/inspector
 
 ## Third-Party Components
 
-See `NOTICE` for licenses. MCP-Bastion uses Meta Llama Prompt Guard 2 (Llama 4 Community License) and Microsoft Presidio. For OWASP-relevant mitigations, dependency audit, and reporting vulnerabilities, see [docs/SECURITY.md](docs/SECURITY.md).
+See `NOTICE` for licenses. MCP-Bastion uses Meta Llama Prompt Guard 2 (Llama 4 Community License) and Microsoft Presidio. For OWASP-relevant mitigations and dependency audit, see [docs/SECURITY.md](docs/SECURITY.md). To report vulnerabilities privately, see [SECURITY.md](SECURITY.md).
 
 ## License