# MCP Server {#mcp-server}

Cyphrex is a remote MCP server at https://mcp.cyphrex.io/mcp. Cursor, Claude, and ChatGPT setup is on [Use Cyphrex with your AI](/docs/ai).

Authenticate with `Authorization: Bearer ${CYPHREX_API_KEY}` on the MCP session. Do not pass the API key in tool arguments. Clients often store tool arguments in conversation history.

### Available tools

- `register_agent` — name, type, and description. Returns a Cyphrex agent id.
- `check_action` — agent id and an action. Checks it against the agent behavior profile.
- `get_audit_log` — agent id and an optional limit. Returns recent actions for that agent.

### MCP Threat Scanner {#mcp-threat-scanner}

Cyphrex scans every MCP tool call in real time and enforces policy at the point of action. When your agent connects to an MCP server through Cyphrex, the gateway checks:

- **Tool description scanning** detects prompt injection attempts embedded in tool descriptions and names. Poisoned tool lists are not returned to the agent when severity meets the agent `gateway_block_severity` (default `high`).
- **Tool poisoning detection** diffs tool schemas against stored snapshots. A changed definition at or above the block threshold is withheld from the caller.
- **Server URL validation** checks MCP server URLs against your agent behavior profile allowed domains. Unauthorized servers are blocked before `tools/call` is forwarded, and logged.
- **Tool result scanning** is post execution detection of PII patterns, prompt injection in response content, and unexpected data volumes. It cannot prevent the upstream call. Findings are logged as detection, not as a block.

Per agent settings on the behavior profile: `gateway_block_severity` (default `high`) and `gateway_fail_mode` (default `closed`; a scanner error blocks rather than forwarding).

To use the gateway, route MCP tool calls through:

```text
POST https://mcp.cyphrex.io/mcp/gateway
{
  agentId: your-agent-id,
  upstreamUrl: https://your-mcp-server.com/mcp,
  message: { jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }
}
```

The response includes `outcome: "blocked"` or `"forwarded"`. Blocked requests have `upstream: null`. Threats are logged in the dashboard under **Security → MCP Threats** with severity levels, tool names, and server URLs.

### MCP Gateway {#mcp-gateway}

Route an agent's MCP `tools/call` and `tools/list` traffic through Cyphrex so policy is enforced at the point of action. On `tools/call` the order is:

1. Policy check via the Cyphrex check endpoint, using action type `tool_use`
2. Upstream server validation
3. Forward, only if both pass
4. Result scan (post execution detection, not prevention)

A block returns a JSON-RPC error with `upstream: null`. The upstream request is never made. The response includes `blockSource`: `policy` when the check endpoint denied the action, or `threat` when server validation or tool poisoning stopped it.

Two settings on the agent behavior profile control gateway behavior:

- `gateway_block_severity` defaults to `high`. Threats at this severity and above are blocked.
- `gateway_fail_mode` defaults to `closed`. Fail closed means a scanner error blocks rather than forwarding. A scanner that cannot run is not evidence that the request is safe. Set `open` only if you want a scanner error to forward with a warning.

Coverage: routing through `tool_use` means the gateway evaluates off limits actions, rate limits, freeze, and prompt injection, but not `allowed_apis` or `blocked_apis`, which apply only to `http_call`, nor `data_scopes`, which apply only to `data_access`. MCP server URL policy is enforced separately by server validation.

### Registry

Listed in the official MCP registry as `io.github.getcyphrex/cyphrex-mcp`.

Source: [github.com/getcyphrex/cyphrex-mcp](https://github.com/getcyphrex/cyphrex-mcp).