← Back to Home

Features Deep Dive

This page introduces MCPProxy's tool discovery and quarantine controls. For setup steps and current options, follow the linked documentation.

Intelligent Tool Discovery & Token Optimization

A primary challenge when working with many AI tools is "context window bloat." Language models have a limited context window, and filling it with dozens or hundreds of tool function schemas is inefficient and expensive. It degrades performance and consumes tokens that could be used for more important tasks.

How MCPProxy Solves This

In its default discovery mode, MCPProxy exposes a small set of built-in tools, including retrieve_tools, instead of loading every upstream tool definition into the client at once.

1. Indexing: MCPProxy discovers approved tools from connected upstream servers and indexes their metadata with BM25.
2. Search on demand: An agent can call retrieve_tools with a task description and inspect the matching results before using a tool.
3. Relevant results: The agent receives matching tool information as needed. The context saved depends on the connected servers, client behavior and how many tools the task uses.

The Benefit: Less Tool Context Up Front

On-demand discovery can avoid sending a large catalog of tool schemas at the start of a session. MCPProxy does not promise a fixed percentage of token savings for every client or workload. See the search and discovery documentation for the current behavior.

Security Quarantine System

Untrusted server and tool descriptions can contain instructions aimed at an agent. MCPProxy can hold new servers and changed tool definitions for review before their tools become available.

What are Tool Poisoning Attacks?

A tool poisoning attack places malicious instructions in a tool's description or schema. An agent that follows them could be led to:

• Reading sensitive files from your computer (e.g., SSH keys, cloud credentials).
• Exfiltrating data to an attacker's server.
• Executing harmful commands on your system.
• Overriding instructions from other, trusted tools.

How the Quarantine Protects You

With quarantine enabled and manual trust mode, MCPProxy holds first-seen servers and changed tool definitions for review. Other trust modes and an explicit "quarantined": false setting can change that behavior.

1. Admission: A newly added server is held under the default manual trust mode. Its tools are excluded from search and calls while it is quarantined.
2. Change review: MCPProxy hashes tool definitions and holds a definition that changes after approval until it is reviewed again.
3. Inspection: The Web UI, CLI and quarantine_security MCP tool can show held servers and tool definitions for analysis.
4. Approval authority: An MCP client with admin access can approve held items through MCP management tools. Scoped agent tokens cannot. Give agents scoped credentials and require MCP authentication when you rely on that boundary.

These controls reduce exposure; a clean scan or approved description does not prove a server's code is safe. See the server quarantine and tool quarantine documentation for setup and limitations.