MCP Defender

MCP Defender is a narrow tool that solves a problem most teams haven't named yet. The Model Context Protocol is how Claude, Cursor, VS Code, and Windsurf reach outside their sandbox — file systems, shells, internal APIs — and everything that reaches out is a potential attack surface. Prompt injection through a poisoned MCP server is not theoretical; it's the same class of bug that has burned agent frameworks for two years. What MCP Defender does that generic firewalls don't is understand the shape of an MCP tool call. It can see that a call is asking to read ~/.ssh/id_rsa or spawn a remote shell, and it can weigh that against signature rules and an LLM's read of intent. That's the layered design in the product: deterministic signatures catch known-bad patterns cheaply, and the LLM pass catches the novel stuff. The trade-offs are real. It's desktop-only, which means no protection for server-side agents or CI pipelines. It's a proxy, so there's a hop between your IDE and every MCP server, and if the proxy or your LLM provider has a bad day, that's on your critical path. Requiring your own LLM API key for the analysis layer means an extra bill and an extra vendor relationship, plus the obvious question of what data that provider sees — the vendor's answer is that scanning is local, but the LLM call itself leaves the machine unless you point it at a local model. The free tier's 250-transaction ceiling is generous for evaluation and tight for daily use, and Starter ships with no support at all, which matters for a security tool. Basic at $29.99 per user per month is a per-seat price for a per-machine product, so small teams should do the math before rolling it out broadly. The Docker acquisition is the strongest signal here. Security tooling lives or dies on whether someone maintains the signatures and patches the parser, and a solo or venture-dependent project can vanish. Docker has an obvious strategic interest in the MCP ecosystem — it already ships MCP tooling through its catalog — so this looks like a real home rather than an aqui-hire. For a solo dev who lives in Cursor, install it, run the free tier, watch the scan activity for a week, and decide whether the alerts are signal or noise. For a security team with MCP-dependent workflows and compliance obligations around auditing AI tool calls, the Enterprise tier's admin roles and audit logging are the part that actually matters. What MCP Defender is not: a SIEM, a cloud workload protector, or something that watches your production agents. Treat it as one specific layer, and it earns its keep.