Hierarchical MCP Gateways: Zero-Trust Proxy

┌────────────────────────────────────────────────────────┐
│                   AI AGENT CLIENTS                     │
│    Developer Claude, Internal Slackbots, Batch SRE     │
└──────────────────────────┬─────────────────────────────┘
                           │ mTLS / Bearer JWT
                           ▼
┌────────────────────────────────────────────────────────┐
│             ZERO-TRUST MCP GATEWAY (ENVOY)             │
├────────────────────────────────────────────────────────┤
│ 1. OIDC / SAML Identity Verification                   │
│ 2. Tool-Level RBAC Policy (Allow/Deny Matrix)          │
│ 3. SQL / Command Sanitizer (Block DROP, TRUNCATE, RM)  │
│ 4. DLP Engine (Regex Redact SSN, API Keys, Credit Card)│
│ 5. Rate Limiter (Token Bucket per Agent ID)            │
└──────────────────────────┬─────────────────────────────┘
                           │ Verified Internal RPC
       ┌───────────────────┼───────────────────┐
       ▼                   ▼                   ▼
┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│ Upstream MCP │    │ Upstream MCP │    │ Upstream MCP │
│ Production DB│    │ AWS Cloud    │    │ Internal HR  │
└──────────────┘    └──────────────┘    └──────────────┘

# mcp-gateway-policy.yaml
version: "2026.1"
policies:
  - role: "junior-developer-agent"
    allowed_servers:
      - "postgres-staging"
      - "github-readonly"
    tool_rules:
      - server: "postgres-staging"
        action: "allow"
        tool: "query"
        constraints:
          disallowed_keywords: ["DROP", "ALTER", "TRUNCATE", "DELETE", "GRANT"]
          max_row_limit: 100
      - server: "postgres-staging"
        action: "deny"
        tool: "execute_ddl"

  - role: "sre-incident-agent"
    allowed_servers:
      - "postgres-prod-readonly"
      - "datadog-mcp"
      - "k8s-mcp"
    dlp_rules:
      mask_fields: ["email", "password_hash", "credit_card", "ssn"]
      action: "replace_with_hash"

// mcp_zero_trust_proxy.ts
import { Request, Response } from "express";

interface JsonRpcRequest {
  jsonrpc: string;
  id: string | number;
  method: string;
  params?: any;
}

const FORBIDDEN_SQL_PATTERNS = [/drop\s+table/i, /truncate\s+table/i, /delete\s+from/i];

export async function handleMcpProxy(req: Request, res: Response) {
  const agentRole = req.headers["x-agent-role"] as string;
  const rpcBody: JsonRpcRequest = req.body;

  // Intercept tools/call execution
  if (rpcBody.method === "tools/call") {
    const { name, arguments: args } = rpcBody.params || {};

    // 1. RBAC check
    if (agentRole === "junior-developer" && name.includes("admin")) {
      return res.status(403).json({
        jsonrpc: "2.0",
        id: rpcBody.id,
        error: { code: -32001, message: "Policy Denied: Role lacks administrative tool permissions." }
      });
    }

    // 2. SQL injection and destructive keyword check
    if (args?.sql) {
      for (const pattern of FORBIDDEN_SQL_PATTERNS) {
        if (pattern.test(args.sql)) {
          return res.status(400).json({
            jsonrpc: "2.0",
            id: rpcBody.id,
            error: { code: -32002, message: "Security Violation: Destructive query keywords rejected by Gateway." }
          });
        }
      }
    }
  }

  // 3. Forward verified request to upstream MCP server
  const upstreamRes = await forwardToUpstream(rpcBody);

  // 4. Data Loss Prevention (DLP): Redact sensitive data in return payloads
  const sanitizedRes = redactSensitiveData(upstreamRes);

  return res.json(sanitizedRes);
}

function redactSensitiveData(data: any): any {
  let str = JSON.stringify(data);
  // Redact API keys and secrets
  str = str.replace(/ghp_[a-zA-Z0-9]{36}/g, "[REDACTED_GITHUB_TOKEN]");
  str = str.replace(/sntrys_[a-zA-Z0-9]{40}/g, "[REDACTED_SENTRY_TOKEN]");
  return JSON.parse(str);
}

async function forwardToUpstream(body: any) {
  // Upstream fetch logic here...
  return { jsonrpc: "2.0", id: body.id, result: { content: [{ type: "text", text: "Safe query result" }] } };
}