Peeyushm3980

MCP Intercepter — Security skill for Claude Code

Security community

Transparent proxy + enterprise gateway for MCP: audit logging, tool allow/deny policy, secrets/PII redaction, and OpenTelemetry for every AI agent <-> MCP tool call.

How to install MCP Intercepter

This entry records only its repository, not the path inside it, so there is no exact command to give. Open Peeyushm3980/mcp-intercepter and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What MCP Intercepter does

Transparent proxy + enterprise gateway for MCP: audit logging, tool allow/deny policy, secrets/PII redaction, and OpenTelemetry for every AI agent <-> MCP tool call.

Alternatives in Security

Mcp-scan (Invariant Labs) — MCP security scanner with proxy mode for real-time scanning without infrastructure changes 1.9k ★
OpenTag — Open-source, channel-native agent gateway for Slack 499 ★
Security Check — Scan project for security issues — exposed secrets, missing .gitignore entries, unsafe patterns 335 ★

README

MCP Intercepter

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE) [![Python 3.9+](https://img.shields.io/badge/python-3.9+-blue.svg)](pyproject.toml)

**See and control every message your AI agent sends to every MCP tool it uses.**

MCP servers can read your filesystem, hit internal APIs, and execute arbitrary tool calls on an agent's behalf — usually with zero visibility and zero policy enforcement. This repo adds both, at whichever scale you need:

interceptor.py — a zero-dependency, single-file stdio proxy. Wraps one local MCP server, transparently logs every request/response to JSONL. Drop it in front of anything in under a minute. Jump to docs ↓
gateway/ — a central HTTP gateway for company-wide rollout: one auth layer, one tool allow/deny policy engine, automatic secrets/PII redaction, one audit trail, OpenTelemetry out the other side. Point every employee's MCP client at it instead of each spawning its own unaudited server. Jump to docs ↓
mcpb/ — one-click Claude Desktop install bundles for both, so rollout doesn't mean hand-editing JSON config. Jump to docs ↓

interceptor.py (local, per-machine)

A transparent stdio proxy that sits between an MCP client (your AI agent — Claude Desktop, Claude Code, etc.) and a real MCP tool server. It forwards every byte unchanged in both directions while logging the full JSON-RPC traffic to a separate `.jsonl` file, so the protocol stream your agent sees stays completely clean.

No dependencies — pure Python 3 standard library.

How it works

AI agent  <--stdio-->  interceptor.py  <--stdio-->  real MCP server (spawned)
                              |
                              v
                     logs/--.jsonl

The interceptor is registered in your agent's MCP config *instead of* the real server. It spawns t