Arbitus

Arbitus

[](https://crates.io/crates/arbitus) [](LICENSE) [](https://github.com/arbitusgateway/arbitus/actions/workflows/ci.yml)

Open-source firewall for MCP tool calls. Arbitus sits between AI agents and MCP servers, then blocks secret leaks, dangerous tools, runaway loops, and unapproved actions before requests reach upstream.

Agent (Claude Code, Cursor, OpenAI Agents SDK, etc.)
        │  JSON-RPC
        ▼
      arbitus     ← auth, rate limit, HITL, payload filter, audit
        │
        ▼
  MCP Server (filesystem, database, APIs...)

Use it when you want developers to keep using AI agents without giving every agent unrestricted access to your filesystem, databases, internal APIs, or production tools.


Why teams use it

• Stop secret exfiltration — block or redact .env values, API keys, private keys, bearer tokens, and encoded variants before they leave the agent runtime
• Constrain agent tools — expose only approved tools through tools/list, then enforce the same policy on tools/call
• Control blast radius — rate-limit agents per minute, per tool, and per IP so loops do not become budget or infrastructure incidents
• Approve risky actions — require Human-in-the-Loop approval before writes, deletes, deploys, database mutations, or shell-like tools run
• Keep an audit trail — record every decision with request IDs and send events to SQLite, webhooks, CloudEvents, OpenLineage, Prometheus, or OTLP backends

Threats Arbitus blocks

Threat	Example	Arbitus control
Secret exfiltration	An agent sends .env, API keys, bearer tokens, or private keys through tools/call arguments	Encoding-aware payloa