devwebxyn/securemcp-lite
A lightweight local MCP firewall for AI agents that enforces YAML security policies on tool calls.
Platform-specific configuration:
{
"mcpServers": {
"securemcp-lite": {
"command": "npx",
"args": [
"-y",
"securemcp-lite"
]
}
}
}Add the config above to .claude/settings.json under the mcpServers key.
<p align="center"> </p>
<h1 align="center">SecureMCP-Lite</h1>
<p align="center"> Lightweight local MCP firewall for AI agents. <br /> Policy-driven, stdio-first, easy to adopt, built for real developer workflows. </p>
<p align="center"> <strong>Protect MCP tool calls before they reach the target server.</strong> </p>
SecureMCP-Lite is a lightweight local proxy firewall for MCP servers. It sits between an MCP client and a target MCP server, inspects stdio JSON-RPC traffic in real time, and enforces a local YAML policy before risky tool calls reach the upstream server.
It is designed for developers and teams who want to keep using MCP-enabled AI tools without giving those tools unrestricted access to local files, shell commands, or other powerful operations.
Many MCP workflows are useful precisely because they expose powerful tools. That also makes them risky.
SecureMCP-Lite helps reduce risk from:
secure-mcp.ymlstderr logging for ALLOWED and BLOCKEDnpx-friendly CLILoading reviews...