MCP Proxy Policy Lab: Design a Sandboxing Gateway

It is a service placed between an AI agent (the MCP client) and one or more MCP servers. It sees the traffic in both directions, so it can apply a policy the servers do not control: which tools exist, which arguments are acceptable, which identity may call what, and what gets logged. The lab teaches what to put in that policy. A proxy is not part of the MCP specification itself; it is a deployment pattern.

It is when a component that holds authority is tricked into using it for a party that should not have it. The MCP security best practices describe it for MCP proxy servers that use one static client ID with a third-party authorization server: consent that was given once can be reused by an attacker's crafted request. The same shape appears when a low-privilege agent borrows a high-privilege server's authority. The lab covers the second form: check what the caller may do, not what the server may do.

Token passthrough is when an MCP server accepts a token from a client without checking it was issued to that server, then passes it on to a downstream API. The MCP security best practices call it an anti-pattern and say the authorization spec explicitly forbids it. Their listed risks include bypassed security controls, a confusing audit trail and broken trust boundaries.

It stops malformed ones: wrong types, missing fields, unexpected properties and values outside a range or list you define. It does not judge intent. A well-formed call with an in-range value can still be harmful, and a poisoned tool description is text, not a parameter. The lab treats schema checks as one layer.

By pinning. At review time the proxy stores a hash of each approved tool's name, description and input schema; later it compares. Invariant Labs recommends verifying a hash or checksum of the tool description before use. A mismatch should stop the tool being shown to the agent until someone re-reviews it. This is detection of change, not of intent.

It cannot make a malicious server or a poisoned but allowed tool harmless, it cannot judge intent inside an allowed call, it sees nothing that bypasses it, and it cannot decide whether a business action is wise. Approvals for risky actions, least-privilege servers and monitoring remain necessary.

No. The organisation, agent and servers are invented. The research referred to (Invariant Labs, 1 April 2025 on its page) is named as research, and Invariant is a vendor of agent-security tooling.

Each of the 12 decisions scores 0 to 10 and the result is your share of the maximum, with a short band saying what it means. The debrief shows the source behind each rationale. Lines labelled PlayCISO practice are our reasoning, not a statement by a source.