Overview

What you get with the BlueRock Secure MCP Server

The fastest and easiest way to secure FastMCP. The Secure MCP Server provides real-time visibility & alerting to protect the runtime integrity of FastMCP servers. It includes:

  • BlueRock Amazon Linux 2023 (pre-hardened base image)

  • Fast MCP Pythonic Framework v2.13

  • Sample FastMCP-based server

Five simple, high-impact policies (on by default, zero tuning) protect entire classes of both known and unknown agentic AI attacks, including 70% of the CISA KEV. These policies focus on execution-layer behaviors that drive the majority of real attacks. They are on by default and require no tuning.

  1. APPLICATION OS COMMAND INJECTION GUARD (Python & Java) Purpose: Short-circuit RCE chains at the moment of execution. What it catches: Unsanctioned exec/subprocess from Python and process execution from JVM apps (frequent end-stage of deserialization and code injection).

  1. REVERSE SHELL PROTECTION Purpose: Stop post-exploitation command-and-control. What it catches: Spawned shells and remote TTY patterns that turn benign processes into control channels.

  1. CONTAINER DRIFT PROTECTION Purpose: Keep workloads immutable. What it catches: Execution of binaries not present in the original image, common in malware drops that lead to privilege escalation and living-off-the-land resource usage.

  1. CAPABILITY ESCALATION CONTROL Purpose: Prevent privilege creep. What it catches: Attempts to add elevated Linux capabilities that enable host resource access and abuse.

  1. HOST NAMESPACE ESCAPE PREVENTION Purpose: Block container host breakouts. What it catches: Host user attempts to access container data and resources.

Why this matters: These five policies are CVE-agnostic and target the high-signal behaviors attackers rely on across many vulnerabilities. In practice, this small set can address 70% of the CISA KEV without chasing every new CVE. You get strong out-of-the-box protection with near-zero effort.

Upgrade path: Free Tier is visibility and alerting. Paid tiers unlock enforcement (block mode) and fine-grained policy controls.

Last updated