@deepsweepai/mcp-firewall is retired and has security issues that will not be fixed

Summary

mcp-firewall was an early request filter for MCP servers. We have retired it. A security researcher reported ten issues to us privately. Together they mean the package does not reliably enforce the protections it describes. There will be no fixed release. If you use it, plan to remove it.

What is affected

• Caller identity (High). Policy rules, rate limits and the audit log use a client identity taken from the request without verification, so any caller can claim any identity.
• Framework wrappers (High). When the firewall blocks an input or an output, affected LangChain, CrewAI and AutoGen wrapper paths carry on anyway: wrapped code runs with blocked input, and blocked output is returned. MCP SDK tool and notification paths also fail to honor blocks.
• Credential detection (High). Some common credential formats are not detected, including cloud secret keys and passwords sent as named fields. They are forwarded to the upstream server.
• Policy rules (Medium). Rules that check the request parameters object using the string operators matches or contains never match, so they never block anything. This affects content rules in the example policies, and any of your own rules written the same way.
• Audit log (Medium). Fields named apiKey are written to the audit log without redaction. Requests that fail for reasons other than a security block are not written to the audit log at all.
• PII detection (Medium). Text that uses look-alike or invisible characters can pass PII detection.
• Memory checksum (Medium). This check is on by default but is not applied to requests received over HTTP or WebSocket. The checksum is not a signature, so it cannot detect changes made by whoever sends the request.
• Example policies (Low). In the financial example policy, logging and alert rules ranked above deny rules stop those deny rules from running.
• Response redaction (Low). PII redaction of upstream responses does not cover error responses.

What to do

1. Remove @deepsweepai/mcp-firewall. Do not rely on it to protect production systems.
2. Until it is removed:
   • put it only behind a gateway that authenticates callers, and do not use client identity in policies or rate limits;
   • do not rely on its PII or credential detection, its example policies, or its framework wrappers.
3. Check its audit logs (by default under ./logs/) for credentials stored in fields named apiKey. Delete those entries and rotate the keys.
4. If credentials passed through it to an upstream server you do not fully trust, rotate them.

Severity

Credit

Thank you to Vasanthadithya M (LinkedIn) for finding and privately reporting these issues, each with a clear root cause and a working proof of concept.

Timeline

• 2026-09-30: reports received
• 2026-10-01: all ten reproduced and acknowledged
• 2026-10-06: all ten accepted
• 2026-10-13: advisory published; package retirement announced

Contact

Report a security issue to brad@deepsweep.ai.