Overview
What you get with the BlueRock Secure MCP Server
The fastest and easiest way to secure FastMCP. The Secure MCP Server provides real-time visibility & alerting to protect the runtime integrity of FastMCP servers. It includes:
BlueRock Amazon Linux 2023 (pre-hardened base image)
Fast MCP Pythonic Framework v2.13
Sample FastMCP-based server
Five simple, high-impact policies (on by default, zero tuning) protect entire classes of both known and unknown agentic AI attacks, including 70% of the CISA KEV. These policies focus on execution-layer behaviors that drive the majority of real attacks. They are on by default and require no tuning.
APPLICATION OS COMMAND INJECTION GUARD (Python & Java) Purpose: Short-circuit RCE chains at the moment of execution. What it catches: Unsanctioned exec/subprocess from Python and process execution from JVM apps (frequent end-stage of deserialization and code injection).
REVERSE SHELL PROTECTION Purpose: Stop post-exploitation command-and-control. What it catches: Spawned shells and remote TTY patterns that turn benign processes into control channels.
CONTAINER DRIFT PROTECTION Purpose: Keep workloads immutable. What it catches: Execution of binaries not present in the original image, common in malware drops that lead to privilege escalation and living-off-the-land resource usage.
CAPABILITY ESCALATION CONTROL Purpose: Prevent privilege creep. What it catches: Attempts to add elevated Linux capabilities that enable host resource access and abuse.
HOST NAMESPACE ESCAPE PREVENTION Purpose: Block container host breakouts. What it catches: Host user attempts to access container data and resources.
Why this matters: These five policies are CVE-agnostic and target the high-signal behaviors attackers rely on across many vulnerabilities. In practice, this small set can address 70% of the CISA KEV without chasing every new CVE. You get strong out-of-the-box protection with near-zero effort.
Upgrade path: Free Tier is visibility and alerting. Paid tiers unlock enforcement (block mode) and fine-grained policy controls.
Last updated