skillgate

MCP Proxy with PathJail security layer for intercepting and classifying MCP responses from upstream servers.

A malicious skill disguised as a PR-summary helper is flagged CRITICAL and blocked, while a genuine formatter passes SAFE instantly with zero LLM cost. See demo/ to regenerate.

Overview

skillgate is a security-focused MCP proxy daemon that:

• Intercepts responses from upstream MCP servers before they reach your coding agent
• Scans content for malicious patterns using hybrid classification (rules + optional LLM)
• Blocks/quarantines dangerous content based on configurable policies
• Works with any MCP client: Cursor, Claude Code, VSCode Copilot, Gemini CLI, Windsurf

Installation

pip install skillgate

Or install from source:

git clone https://github.com/awsm-research/skillgate
cd skillgate
pip install -e .

Quick Start

1. Register an upstream MCP server

skillgate upstream add skills "npx @anthropic/skills serve"

2. Configure your agent

skillgate setup cursor
# or: skillgate setup claude-code
# or: skillgate setup copilot

3. Start the daemon

skillgate daemon start

4. Guard npx skills add (CLI)

Intercept the vercel-labs/skills CLI so every install is pre-scanned before files reach agent directories:

# One-time: put shims ahead of real npx on PATH
skillgate install-skills-shim
export PATH="$HOME/.skillgate/bin:$PATH"   # add to ~/.bashrc / ~/.zshrc

# Now this pre-scans, then runs the real installer:
npx skills add vercel-labs/agent-skills --skill some-skill -y

Or call the wrapper directly (no PATH change):

skillgate skills add ./local-skills --yes

Flow for add: clone/copy source → scan each SKILL.md package (rules + optional LLM) → block/quarantine on HIGH+ → otherwise delegate to npx -y skills add ….

Architecture

Agent (Cursor/Claude/etc)
         │
         │ stdio
         ▼
    ┌─────────────────────────────────────┐
    │         skillgate Daemon             │
    │                                     │
    │  ┌─────────────────────────────┐   │
    │  │    Response Interceptor     │   │
    │  │                             │   │
    │  │  ┌───────┐   ┌──────────┐  │   │
    │  │  │ Rules │──▶│ Classify │  │   │
    │  │  └───────┘   └──────────┘  │   │
    │  │       │           │        │   │
    │  │       ▼           ▼        │   │
    │  │  ┌─────────────────────┐   │   │
    │  │  │   Policy Engine     │   │   │
    │  │  │ block/quarantine/   │   │   │
    │  │  │ warn/allow          │   │   │
    │  │  └─────────────────────┘   │   │
    │  └─────────────────────────────┘   │
    └─────────────────────────────────────┘
         │
         │ stdio
         ▼
    Upstream MCP Server (skills, filesystem, etc.)

CLI Reference

Daemon Control

skillgate daemon start           # Start in background
skillgate daemon start -f        # Start in foreground
skillgate daemon stop            # Stop daemon
skillgate daemon status          # Show status
skillgate daemon logs -f         # Tail audit log
skillgate daemon install         # Install as system service

Upstream Management

skillgate upstream add <name> "<command>"
skillgate upstream remove <name>
skillgate upstream list

Agent Setup

skillgate setup cursor
skillgate setup claude-code
skillgate setup copilot
skillgate setup gemini
skillgate setup windsurf

Scanning

skillgate scan path/to/SKILL.md
skillgate scan --recursive ./skills/

Quarantine

skillgate quarantine list
skillgate quarantine show <hash>
skillgate quarantine approve <hash>
skillgate quarantine reject <hash>

Configuration

skillgate config show
skillgate config edit

Hybrid architecture (regex prefilter → LLM classifies)

Regex does not decide the final label. It only finds suspicious regions to shrink LLM input:

1. Strict prefilter — broad regex (no doc/allowlist suppression) flags anything that looks suspicious
2. No hits → SAFE, no LLM call (saves tokens)
3. Hits → send excerpt payload only (fenced blocks + context windows) to the LLM
4. LLM alone returns SAFE / SUSPICIOUS / MALICIOUS

use_llm: true
hybrid_prefilter_context_window: 500   # chars around each hit
hybrid_prefilter_max_snippets: 20

Configuration

Configuration is stored in ~/.skillgate/config.yaml:

http_port: 9847          # Optional HTTP port
use_llm: false           # Enable LLM classification
llm_model: gpt-4o-mini   # LLM model to use
llm_backend: openai      # openai, anthropic, or ollama
log_level: INFO

Environment variables (prefix SKILLGATE_):

export SKILLGATE_USE_LLM=true
export SKILLGATE_LLM_API_KEY=sk-...

Detection Patterns

Built-in rules detect:

• Remote Code Execution: curl|bash, wget|sh, eval(), etc.
• Credential Access: .ssh/, API keys, tokens
• Prompt Injection: "ignore previous instructions", system prompt manipulation
• Path Traversal: ../../../etc/passwd
• Network Threats: reverse shells, netcat listeners

Custom rules can be added in ~/.skillgate/rules/custom.yaml.

Policy Actions

Severity	Default Action
CRITICAL	Block
HIGH	Quarantine
MEDIUM	Warn
LOW	Allow

Customize in ~/.skillgate/config.yaml:

policies:
  CRITICAL:
    action: block
    notify: true
  HIGH:
    action: quarantine
    require_approval: true
  MEDIUM:
    action: warn
    annotate_response: true

Development

# Install dev dependencies
pip install -e ".[dev]"

# Run tests
pytest

# Run linter
ruff check .

# Type checking
mypy skillgate

License

MIT