01
AI Agent
Makes a request to get work done
The agent decides what it needs and sends a tool call toward the MCP ecosystem. Bindfort treats this traffic as hostile until proven otherwise.
MCP SECURITY & EVIDENCE GATEWAY
Secure every MCP tool callbefore it runs
Bindfort sits between AI agents and MCP servers — it enforces policy before each call and signs receipt evidence after.
- BEFORE THE CALLPolicy firstBlock bad calls before they run
- SUPPLY CHAINDeep scanCheck the installed dependency tree
- ROADMAPRuntime guardrailsContainment hardening is next
- AFTER THE CALLReceiptsSigned proof after each call
EXECUTION PIPELINE / REQUEST WALKTHROUGH
Demo / what the gateway records
Every decision becomes a receipt
Simulated data replaying the local verification path. Pilot deployments produce these records from real traffic.
Policy engine
allow + denyboth enforced before upstream execution
Dependency-tree scan
2 HIGHadvisories found in every official MCP server we audited
Audit receipts
000receipts written this demo session
Decision stream (demo)
- 00:00:03ALLOWtools/call echomatched allow rule
- 00:00:06ALLOWtools/call search_docsmatched allow rule
- 00:00:09BLOCKtools/call blocked_tooldenied before upstream
- 00:00:12ALLOWtools/listdiscovery permitted
MCP security evidence from the current research and verification pass
5/5
official MCP servers flagged
installed-tree audit found two HIGH advisories in every official server we tested / read audit
43%
MCP servers vulnerable
external ecosystem scan reported command-injection exposure / BlueRock scan
allow+deny
policy enforcement working
both sides proven before upstream execution. End-to-end gateway latency is measured per pilot; the 0.9µs figure is a policy-path microbenchmark only, not full-path latency.
Product status / one place for readiness
What is working now, and what is on the roadmap
One honest status board. Each module is labelled by outcome: working today, ships today, or still roadmap.
Installed-tree scanning
The scanner path is built around the runtime dependency tree, not only top-level package names. This is the core lesson from the MCP transitive dependency research, and it is what powers the free audit.
Working: deep installed-tree scan
Inline policy enforcement
Both sides of the policy gate are proven: an approved tool call succeeds and a denied tool is stopped before it reaches the upstream MCP server.
Working: allow and deny both enforced
Receipt evidence
Tool-call results include receipt evidence with HMAC and server fingerprint fields. For EU buyers, this becomes the audit artifact behind Article 12-style traceability: who called which MCP tool, under which policy, and what result came back. Thebindfort verify command proves receipt-log integrity after the run and fails on tampered records — tamper one line and it exits non-zero.
Ships today: receipt integrity verifier
Annex IV documentation support
Receipts, policy decisions, scanner findings, and server fingerprints give operators structured evidence they can attach to technical documentation, supplier review, and Annex IV readiness work.
Working: structured evidence export
Isolation hardening
The product direction is clear: run untrusted MCP servers with scoped filesystem, network, and process access. First-user packaging still needs a clean deployment profile.
Roadmap: isolation hardening
EU-first deployment packaging
Bindfort now has first-user packaging docs, a Compose skeleton, and a pilot checklist aligned to EU audit and sovereignty expectations. Before broader launch it still needs one external pilot run and production-grade deployment packaging.
Roadmap: one pilot from launch
Real MCP incidents
This already happened
The security case does not depend on one regulation. These disclosed MCP incidents show why fast policy checks, dependency visibility, and receipt evidence need to exist before tools run.
CVE-2025-54136
Cursor MCPoison trust bypass
Approved MCP configuration could be changed later without the user seeing a fresh trust decision, turning an approved setup into persistent code execution risk.
Config drift / trust boundaryCheck Point Research ->
CVE-2025-6514
mcp-remote command execution
Connecting an MCP client through mcp-remote to an untrusted server could trigger arbitrary operating-system command execution on the client host.
Transport bridge / RCEJFrog Security Research ->
CVE-2025-53109 / 53110
EscapeRoute filesystem path escape
Anthropic's Filesystem MCP server contained path-scope bypasses that let attackers escape the intended directory boundary and access host files.
Filesystem boundaryCymulate ->
April 2026
Systemic MCP SDK command execution
OX Security reported a design-level command execution surface in MCP STDIO handling across official SDK implementations and downstream products.
SDK architectureOX Security ->
Research / evidence
Research that explains the MCP risk
Start with the evidence behind the product: installed-tree dependency risk, runtime reachability, and the minimum checks before agents use MCP servers.
Bindfort Research / May 2026
Installed-tree scanning catches what shallow MCP scans miss
A shallow package scan can return clean while the installed dependency tree still carries known high-severity advisories.
Read the report ->Bindfort Research / Runtime validation
Presence is not reachability
Dependency presence is only the first question. Runtime validation asks whether an agent can actually drive traffic into the affected path.
Read validation notes ->Bindfort Checklist
What operators should check before agents use MCP servers
Inventory, dependency depth, host/origin boundaries, policy enforcement, and receipts are the minimum review set before production use.
Open checklist ->Compliance use case / sovereignty / audit evidence
Evidence infrastructure cannot be backfilled
The EU AI Act timeline moved, but the MCP risk did not. The current planning baseline for stand-alone Annex III high-risk systems is now 2 December 2027 after the AI Omnibus political agreement. That gives teams more room to implement calmly, not permission to postpone telemetry, policy records, and receipt evidence.
The CVEs do not care about Brussels. Tool poisoning, command execution, dependency drift, and filesystem escapes are already showing up in MCP stacks. Bindfort turns sensitive MCP tool calls into reviewable evidence: caller, server identity, tool, policy decision, timestamped result, receipt hash, and verifier output. Start now, comply calmly.
Article 12automatic event logging support
Annex IVtechnical documentation evidence
Dec 2, 2027Annex III planning baseline
Customer controlself-hosted VPC or EU-controlled deployment option
Bindfortsigned MCP receipts verified by CLI
bindfort verify receipts.jsonl --key-file receipt.keyFAQ / current readiness
What works today
and what is roadmap
Today
How does this help with the EU AI Act?Today
Article 12 requires high-risk AI systems to technically allow automatic event logging over the system lifetime. Bindfort is positioned to provide the MCP tool-call side of that record: caller, tool, server identity, policy decision, timestamped result, and receipt evidence.
Annex IV is about technical documentation. Bindfort does not make a system compliant by itself, but its receipts, dependency findings, policy records, and server fingerprints are the kind of structured evidence EU operators need for audit files and design-partner reviews. The Annex III planning baseline is now 2 December 2027, but evidence infrastructure cannot be backfilled. Start now, comply calmly.
The local verification path can generate a verifier-backed evidence bundle from receipt logs withbindfort evidence bundle.
Can I verify a receipt today?Today
In the current verification path, the local demo writes receipt evidence with HMAC and server fingerprint fields. The bindfort verify receipts.jsonl command recomputes the HMAC chain from a signing key kept outside the log, exits non-zero on tampering, and reports the receipt that failed.
After verification, bindfort evidence bundle writes a local manifest, Article map, and operator README without copying raw receipt logs by default.
Is Bindfort ready for users today?Today
It is ready for a guided technical walkthrough and design-partner evaluation. The verified path currently covers config validation, build, tests, policy allow/deny behavior, and receipt evidence.
It is not yet a self-serve production product. First-user packaging and operator docs now exist as a guided path; the remaining launch work is one real pilot environment, release artifacts, and production operations packaging.
How is this different from a routing MCP gateway?Today
Routing gateways forward MCP traffic and usually focus on auth, rate limits, and transport. Bindfort focuses on security evidence before and after the call: installed dependency risk, policy decision, tool-call outcome, and receipt records.
Can this run in an EU-controlled environment?Today
That is the intended deployment posture for design partners: self-hosted deployment that keeps agent traffic, tool-call evidence, and audit records under the operator's control instead of requiring sensitive traces to leave the environment or the jurisdiction.
v1.0 roadmap
What about SOC 2?v1.0 roadmap
Bindfort is not claiming SOC 2 certification today. The current value is that policy decisions, receipt records, scanner findings, and server fingerprints can support future control evidence for audits.
Formal SOC 2 mapping, auditor-ready exports, and control evidence workflows are v1.0 roadmap work. Self-hosting helps with data control, but it does not remove the buyer's audit obligations.
Who is behind this — verify the code, not the founder
Built by a small EU team in Poland.
Bindfort is run as a deliberately low-profile, EU-based effort. We would rather you trust verifiable artifacts than a bio. The evidence format is open by design: the bindfort verify receipt verifier recomputes the HMAC chain and fails on tampered records, and the dependency-scan findings are reproducible from a frozen baseline. Receipts stay verifiable even without us.
The same scan behind the installed-tree research is published with a frozen baseline at tests/cve-scan-bootstrap/out-baseline-2026-04-26/ so findings can be re-run and diffed.
Paid pilots from EUR 500-1,500 / free MCP scan first.
Request a free MCP scan, then review the gateway
Send your MCP server list or a lockfile and get a findings report in 48 hours — the same installed-tree scan that flagged 5 of 5 official MCP servers. We prioritise teams that already run MCP servers, connect agents to internal tools, or need tool-call control and receipt evidence.
Design-partner stage: guided pilots, not self-serve.