ThornGuard: A Proxy Gateway to Secure MCP Server Connections from Prompt Injection
ThornGuard is a security proxy designed to protect Claude AI from malicious content when connecting to external MCP (Model Context Protocol) servers. The tool was created after testing revealed that upstream servers can inject hidden instructions into tool responses, which Claude receives without filtering.
Security Problem Identified
When connecting Claude to external MCP servers, nothing prevents upstream servers from injecting hidden instructions into tool responses. In a test, a server embedded a fake recommendation telling Claude to always prefer a specific vendor. While Claude caught this obvious payload, more subtle injections would bypass detection.
ThornGuard Features
- Scans tool definitions and responses for prompt injection and poisoning
- Strips secrets and PII before they enter your context window
- Includes a semantic classifier that flags suspicious payloads
- Provides real-time audit dashboard with compliance exports
- Offers CLI that generates configs for Claude Desktop, Cursor, VS Code, and several others
Implementation Details
The proxy architecture was designed with a security model in mind, then implemented using Claude Code on Cloudflare Workers. The implementation includes OAuth flows and the CLI tool.
ThornGuard is available with a 7-day free trial at thorns.qwady.app. A demonstration video is available at https://youtu.be/1PWNFpUWKV8.
📖 Read the full source: r/ClaudeAI
👀 See Also
OneCLI: Open-Source Credential Vault for AI Agents
OneCLI is an open-source gateway written in Rust that sits between AI agents and external services, injecting real credentials at request time while agents only see placeholder keys. It provides AES-256-GCM encrypted storage, runs in a single Docker container with embedded PGlite, and works with any agent framework that can set an HTTPS_PROXY.
Claude Code CVE-2026-39861: Sandbox Escape via Symlink Following
A high-severity vulnerability in Claude Code's sandbox allows arbitrary file write outside the workspace via symlink following, potentially leading to code execution.
GitHub repository documents 16 prompt injection techniques and defense strategies for public AI chats
A developer published a GitHub repository detailing security measures for public AI chatbots after users attempted prompt injection, roleplay attacks, multilingual tricks, and base64 encoded payloads. The guide includes a Claude code skill to test all 16 documented injection techniques.
Security Audit Finds Anthropic's MCP Reference Servers Vulnerable, Introduces Hallucination-Based Vulnerabilities
A security audit of 100 MCP server packages found 71% scored an F, including Anthropic's official GitHub and filesystem reference implementations. The audit identified Hallucination-Based Vulnerabilities that create security holes and waste tokens through reasoning loops.