mcpguard-dynamic
Kernel-level eBPF sandbox for securing LLM agent tool calls made through the Model Context Protocol (MCP)
by facebookC
Commit activity
Last 12 weeks · 1 commit
Community health
4 of 6 standards met
75
✓README✓License✓Contributing✓Code of Conduct○Issue Template○PR Template
Recent PRs & issues
Active · 1 in progress · Last activity 1mo ago
See all on GitHub →
build: improve bpftool discovery and add graceful eBPF type fallbacks Description This Pull Request resolves two critical build and runtime issues encountered when compiling and running on custom or RC kernels (e.g., Linux 7.0.0-rc4). 1. Robust Discovery The Issue: On Ubuntu systems, the default binary is often a wrapper script provided by . This wrapper strictly checks for the presence of kernel-specific packages (e.g., ). If that package is unavailable (which is common for custom builds), the wrapper outright crashes with exit code 1, even if a perfectly functional exists in the directory. This causes the BTF dump and map updates to fail entirely. The Fix: Modified and to dynamically verify if the default wrapper actually works (via ). If it fails, they seamlessly fallback to searching for a working binary, ensuring the build and runtime orchestrator degrade gracefully. 2. Graceful eBPF Type Fallbacks in The Issue: When generates from custom kernels, it occasionally strips out or fails to include the standard and primitive types. When is subsequently included, clang throws a fatal error. The Fix: Added C11-compliant identical typedef definitions for and into . Because C11 permits identical typedef redefinitions, this acts as a completely safe and transparent fallback if stripped them, while compiling cleanly on kernels where they already exist. Proof of Fix Tested extensively on . now successfully compiles all objects without fatal unknown type errors. successfully provisions the BPF maps without crashing on the broken wrapper script. Type of Change [x] Bug fix (non-breaking change which fixes an issue) [ ] New feature (non-breaking change which adds functionality) [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
Recent fixes
What (L1, ) claimed to enforce per-tool network allow-lists for URL arguments, but the check only verified that was non-empty. Any destination host was therefore permitted for a tool whose policy declares specific allowed domains. Threat model Per README, the MCP server is untrusted. A trojanized or malicious server can pass a URL-shaped argument (e.g. a fetch/translate/web tool) to exfiltrate data to an attacker-controlled host even when the operator's policy allows only . The AgentBound baseline in this repo already denies this exact case (, ), so L1 was inconsistent with the intended enforcement. Fix Parse the URL with and match the host against the tool's entries: bare host matches the exact host and its subdomains entries match the host regardless of URL port , wildcard entries allow any host matches subdomains only (not the apex) malformed URLs fail closed (DENY) Verification Before: -> ALLOW. After: DENY; the allowed host still ALLOW. Regression self-check added: (PASS). clean; reports no formatting change. All 82 test-case tool calls run through the fixed engine with zero outcome changes (no benchmark case passes a bare URL argument; the URL-prefix cases are inside / values and are handled by the existing syscall-deny branch). Note: the full eBPF smoke test () requires Linux (it fails at on non-POSIX hosts); this change is pure-logic L1 and is covered by the self-check.
Structured data for AI agents
Repository: facebook/mcpguard-dynamic. Description: Kernel-level eBPF sandbox for securing LLM agent tool calls made through the Model Context Protocol (MCP) Stars: 72, Forks: 11. Primary language: C. Languages: C (90.7%), Python (8.8%), JavaScript (0.4%), Makefile (0.1%). License: MIT. Open PRs: 1, open issues: 0. Last activity: 1mo ago. Community health: 75%. Top contributors: facebook-github-bot.