Transparent MCP Proxy Gateway
For AI IDEs and clients that lack native execution hooks (such as Cursor IDE, Claude Desktop, and VS Code MCP), ctxsec provides a transparent stdio JSON-RPC proxy.
Architecture
The proxy sits seamlessly between the AI client and any target MCP server:
graph LR
Client["AI Client<br/>(Cursor / Claude Desktop / VSCode)"]
Proxy["ctxsec MCP Proxy<br/>(stdio JSON-RPC Middleware)"]
TargetServer["Target MCP Server<br/>(e.g., Filesystem, GitHub, Shell)"]
Client <-->|stdio| Proxy
Proxy <-->|stdio| TargetServer
subgraph DefenseEnforcement["In-Line Defense"]
Proxy -.-> CEL["CEL Policy Engine"]
Proxy -.-> DLP["Context DLP"]
end
Hold "Alt" / "Option" to enable pan & zoom
Every tools/call JSON-RPC request emitted by the AI client is intercepted and inspected in-flight. If the parameters violate a security policy, the proxy synthesizes a JSON-RPC error response before the target server ever receives the command.
Client Configuration Examples
Claude Desktop (claude_desktop_config.json)
{
"mcpServers": {
"secure-system": {
"command": "ctx",
"args": [
"mcp-proxy",
"--role=coder",
"--upstream", "npx", "-y", "@modelcontextprotocol/server-filesystem", "/path/to/project"
]
}
}
}