Ctxfw runs on your own machine — the client starts it, so there is no endpoint to ping. 343 installs a week from pypi. Last commit 6 Nov 2026.
Zero-egress AI Agent Firewall: SARA prompt injection defense, AST context pruning & MCP governance.
What the code does
We read the source, 23 h ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
res = subprocess.run(
p = subprocess.run(cmd, shell=True, capture_output=True, text=True)
r"|(?<![a-zA-Z0-9_./-])(?:\.env(?:\.[a-zA-Z0-9_-]+)?|\.ssh/[a-zA-Z0-9_.-]+|\.aws/[a-zA-Z0-9_.-]+))",
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add ctxfw -- uvx ctxfw{
"mcpServers": {
"ctxfw": {
"command": "uvx",
"args": [
"ctxfw"
]
}
}
}[mcp_servers.ctxfw]
command = "uvx"
args = ["ctxfw"]{
"mcpServers": {
"ctxfw": {
"command": "uvx",
"args": [
"ctxfw"
]
}
}
}{
"servers": {
"ctxfw": {
"type": "stdio",
"command": "uvx",
"args": [
"ctxfw"
]
}
}
}Alternatives to Ctxfw
same job, measured the same wayMulti-agent LLM security layer detecting prompt injection and jailbreaks.
Prompt-injection firewall for AI agents — scan untrusted text before LLM calls.
Secure MCP gateway and quarantine for AI agent traffic — three-layer prompt injection defense
AI agent governance for MCP: PII detection, policy enforcement, compliance, and kill switch.
Pre-injection context compression for coding agents. Zero LLM calls, zero telemetry, offline-safe.
Three-layer firewall for MCP: content, egress and action policy. Proxy or server.
AI agent security via MCP: C3 firewall, C4 immune system, C5 action guard, self-evolving prompts.
Audit AI agent configs for prompt injection & rogue MCP servers; vet packages
Ctxfw — questions
Answers built from our own checks of this server.