Does MCPD support authorization layer for harness ?

[hajdukd]

Hi,

I'm looking for an MCP Proxy that can be safely deployed anywhere - be it local environment or remote environment that will not only handle routing of agent requests but also verify them from point of view of potential compromise i.e. "bash -c 'cat ~/.aws/credentials'" etc.

Does mcpd also handle verification layer in an easy configurable way or it only reroutes the requests and adds authorization headers ?

[peteski22]

Hi @hajdukd thanks for the question.

Yes, mcpd has a request/response plugin pipeline designed exactly for this.

Plugins run out-of-process around every tool call, organized into categories: authentication, authorization, validation, content (the only category permitted to mutate payloads), rate_limiting, observability, and audit.

A required plugin can reject a request before it ever reaches the upstream MCP server, which is the hook you'd use to block things like the bash -c '...' example.

• Background: mcpd plugins — extend your agent infrastructure without touching your code
• Docs: https://mozilla-ai.github.io/mcpd/plugin-configuration/

Plugin SDKs (pick your language):

• Go — https://github.com/mozilla-ai/mcpd-plugins-sdk-go
• Python — https://github.com/mozilla-ai/mcpd-plugins-sdk-python (examples/)
• Rust — https://github.com/mozilla-ai/mcpd-plugins-sdk-rust (examples/)
• .NET — https://github.com/mozilla-ai/mcpd-plugins-sdk-dotnet (examples/)

For content-level inspection specifically, any-guardrail pairs nicely with a validation or content plugin.