MCPSaaS -- MCPS as a Service

🔒

Message Integrity

Every message is verified end-to-end. If anything is modified in transit -- by proxies, middleware, or compromised dependencies -- it's detected and blocked.

🔄

Replay Protection

Every request is unique. Captured messages cannot be re-sent. Centralised tracking across all your agents with automatic expiry.

🛡

Tool Integrity

Tool definitions are fingerprinted at discovery. If a server silently changes a tool after you approved it (rug pull), the call is blocked before execution.

🎯

Agent Identity

Every agent gets a verifiable identity with trust levels L0-L4. Servers set minimum trust requirements. No more anonymous tool calls.

📄

Audit Trail

Full structured logging in JSON and syslog (RFC 5424). Feed directly into Cribl, Splunk, Datadog, or any SIEM. Complete non-repudiation.

⚡

Zero Friction

Change one URL in your MCP config. No SDK, no library, no key management. Your MCP server doesn't know we exist.

No Message Integrity

Every JSON-RPC message between agent and tool server travels without any integrity verification. Any intermediary -- corporate proxies, CDN workers, compromised dependencies -- can modify parameters without detection.

No Replay Protection

Captured MCP messages can be re-sent by an attacker to repeat sensitive operations. There is no nonce, sequence number, or timestamp binding to detect duplicates.

No Tool Verification

Tool definitions can change after initial approval. A tool called 'read_file' today could silently become 'read_file_and_exfiltrate' tomorrow. No hash-pinning, no mutation detection.

No Agent Identity

Agents authenticate with bearer tokens or API keys. A stolen token means full impersonation. There is no way to verify which specific agent made a request.

TLS Is Not Enough

Transport security terminates at every hop. Corporate HTTPS inspection proxies (Zscaler, Palo Alto, Fortinet) routinely decrypt, inspect, and re-encrypt traffic. After termination, messages are plaintext.

OAuth Doesn't Cover It

OAuth proves who you are but doesn't protect what you send. A valid OAuth token with a modified message body is accepted without question. No message signing, no payload integrity.

30 CVEs in 60 Days

MCP has the fastest-growing attack surface in AI infrastructure. Critical vulnerabilities including RCE (CVE-2025-6514, CVSS 9.6), authentication bypass, and unauthenticated API exposure.

38% Have No Auth

Industry scans of 500+ MCP servers found that 38% lack any form of authentication. Anyone who can reach the endpoint can invoke any tool.

180

Security tests across 19 attack categories

21

Attack surfaces identified in standard MCP

0

Unsigned messages when MCPSaaS is enabled

100%

Replay attacks blocked

🚫

Corporate Proxy MITM

TLS-terminating proxies can modify messages after decryption.

⚡

CDN/Edge Worker Injection

Cloudflare Workers or CDN scripts can intercept and modify MCP traffic.

📦

Supply Chain Compromise

Compromised npm dependencies can intercept from inside your MCP server.

🔄

Replay Attacks

Captured requests can be re-sent to repeat sensitive operations.

🛠

Tool Rug Pulls

MCP servers can silently change tool definitions after approval.

🌐

DNS Hijacking

Fake servers at hijacked domains proxy traffic while modifying it.

LIVE

Setup

1. Register an app in Azure AD with SecurityAlert.ReadWrite.All permission
2. Note your tenantId, clientId, and clientSecret
3. Configure via API:

curl -X POST https://mcpsaas.co.uk/api/defender/config \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tenantId": "YOUR_AZURE_TENANT_ID",
    "clientId": "YOUR_APP_CLIENT_ID",
    "clientSecret": "YOUR_APP_CLIENT_SECRET"
  }'

Test: POST /api/defender/test sends a simulated alert to verify the connection.

LIVE

Setup

1. Get your Log Analytics Workspace ID and Primary Key from Azure Portal > Log Analytics > Agents
2. Add to your Defender config:

curl -X POST https://mcpsaas.co.uk/api/defender/config \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "tenantId": "YOUR_AZURE_TENANT_ID",
    "clientId": "YOUR_APP_CLIENT_ID",
    "clientSecret": "YOUR_APP_CLIENT_SECRET",
    "sentinelWorkspace": "YOUR_WORKSPACE_ID",
    "sentinelSharedKey": "YOUR_PRIMARY_KEY"
  }'

Test: POST /api/sentinel/test pushes a test log entry. Query in Sentinel: MCPSaaS_CL | where ThreatType_s != ""

Example KQL Queries

// All MCP threats in last 24 hours
MCPSaaS_CL
| where TimeGenerated > ago(24h)
| where EventType_s == "threat_detected"
| project TimeGenerated, ThreatType_s, Severity_s, AgentName_s, Detail_s

// Command injection attempts by agent
MCPSaaS_CL
| where ThreatType_s == "COMMAND_INJECTION"
| summarize count() by AgentName_s
| order by count_ desc

// MITRE ATT&CK heatmap
MCPSaaS_CL
| where MITRECategory_s != ""
| summarize count() by MITRECategory_s
| render piechart

LIVE

Endpoints

# JSON audit log
curl https://mcpsaas.co.uk/api/audit \
  -H "Authorization: Bearer YOUR_API_KEY"

# RFC 5424 syslog format
curl https://mcpsaas.co.uk/api/audit/syslog \
  -H "Authorization: Bearer YOUR_API_KEY"

Agent
calls MCP tool

→

MCPSaaS
signs + scans

→

MCP Server
executes tool

Defender
real-time alert

Sentinel
KQL + playbooks

Syslog
Splunk / Elastic / etc

1

Point your agent at MCPSaaS

Replace your MCP server URL with your MCPSaaS proxy endpoint. Your agent connects to us instead of directly to the MCP server. No SDK, no library, no code change.

2

Every call is signed

MCPSaaS cryptographically signs every MCP message passing through the proxy. Tool definitions are pinned on first contact. If a tool schema changes unexpectedly, execution is blocked.

3

Traffic is scanned in real time

A heuristic engine inspects every tool call for known attack patterns -- injection, credential theft, traversal, prompt manipulation. Critical threats are blocked before they reach the MCP server.

4

Alerts flow to your SOC

Blocked threats and security events are pushed to Microsoft Defender, logged to Azure Sentinel, and exported via syslog -- all in real time. Your SOC sees MCP threats alongside everything else they monitor.

Like Cloudflare, but for MCP

MCPSaaS is a transparent security proxy. It does not host your tools or store your data. Traffic passes through, gets signed and scanned, then forwards to your MCP server. If MCPSaaS is unreachable, agents fall back to direct connections. We secure MCP -- we don't replace it.

🛡

Command Injection
MITRE: Command & Control

🔑

Credential Access
MITRE: Credential Access

💾

SQL Injection
MITRE: Initial Access

🧠

Prompt Injection
MITRE: Execution

📁

Path Traversal
MITRE: Collection

🔄

Replay Attacks
Nonce-based rejection

Request Volume (24h)

Security Posture

Agent Trust Levels

Activity Timeline (7 days)