uta-shield MCP server

uta-shield

Provider-side firewall for MCP servers + PhishGuard threat-intel MCP server — in one zero-dependency package.

Landing / docs: https://wall.utalabs.tech

Every gateway in the MCP security category (Lasso, Mintive, Obot, agentgateway, Cequence) protects the consumer — the company whose employees connect agents to third-party servers. Nothing protects the operator — the SaaS that publishes its MCP server and exposes its database to every anonymous agent on the internet.

uta-shield is the mirror side: you wrap YOUR MCP server and gain verified identity, per-tool authorization, threat-intel blocking (in AND out), two-tier rate limits, DLP masking, proxy hardening, per-call metering and a JSONL audit trail — without touching your server code.

Backed by a real, documented campaign: the taikotalent phishing case (fake-recruiter malware against open-source developers, domain taken down in ~12h, C2 infra tracked). The bundled feed ships its 23 verified IOCs.

Quickstart

# 1. Screen any indicator offline (exit code 1 on match → scriptable)
npx uta-shield check gaganata.ink          # → MATCH (C2, campaign taikotalent-2026-10)
npx uta-shield check example.com           # → NO_MATCH

# 2. Screen text (email body, web content, tool output)
echo "verify at https://taikotalent.xyz/verify_m" | npx uta-shield screen

# 3. Run the PhishGuard MCP server (agents get lookup_ioc / check_url / screen_text)
npx uta-shield mcp

# 4. THE FIREWALL: wrap your MCP server (fail-closed: keys or explicit opt-out)
cat > keys.json <<'EOF'
{ "recruiter-agent": "generate-a-long-random-secret", "auditor-agent": "another-secret" }
EOF
npx uta-shield wrap --upstream http://localhost:3001 --port 8787 --keys-file keys.json --admin-token "$(openssl rand -hex 24)"
#    → agents now talk to :8787; your server stays at :3001
#    GET /health · GET /pricing (x402-ready) · GET /audit (admin-only: x-uta-admin header)

# 5. See it all live
node demo/run-demo.mjs

Verified identity (v0.2.0, ACL strict mode v0.2.2)

Identity is no longer declared-only. Agents present three headers:

x-agent-name:      recruiter-agent
x-agent-timestamp: 1761196800000            (ms; ±5 min window)
x-agent-signature: <hex>                    HMAC_SHA256(secret, `${agent}|${ts}|${sha256(rawBody)}`)

• Valid signature → ALLOW_VERIFIED (per-agent rate buckets, ACL enforcement, metering).
• Presented-but-invalid credentials → REJECTAUTH (401). Fail-closed, always.**
• No credentials → REJECT_ANON (401) unless the operator passes --allow-anonymous.
• Declared names (no signature) are labels only, verified:false — they earn no per-agent rate bucket.
• Per-tool ACL (--acl-file): by default, agents absent from the map are unrestricted. For allow-list semantics, add --acl-deny-unlisted — unlisted agents get 403 REJECTFORBIDDEN even with a valid signature. The CLI refuses --acl-deny-unlisted without an ACL file (with no map, deny-unlisted would reject every agent). /health discloses identity.acldeny_unlisted.

Signing a request (client side, any language):

import { createHmac, createHash } from "node:crypto";
const ts = Date.now();
const bodyHash = createHash("sha256").update(rawBody).digest("hex");
const sig = createHmac("sha256", secret).update(`${agent}|${ts}|${bodyHash}`).digest("hex");

The 8 layers

Shortened. The full README is on GitHub.