{"id":47255351,"title":"Show HN: Kvlar – Open-source firewall for AI agent tool calls","points":1,"user":"kvlar","time":1772666190,"time_ago":"10 hours ago","type":"link","content":"

Hey HN, I built Kvlar — an open-source policy engine that sits between AI agents and their tools (MCP servers), evaluating every tool call against YAML security policies before execution.

The problem: AI agents using MCP can execute database queries, push code, send Slack messages, and run shell commands — with no security boundary. Claude Desktop has basic approve/deny, but it's per-call with no persistent rules, no automation, and no audit trail.

How it works: Kvlar runs as a stdio proxy between the agent and the MCP server. You define policies in YAML — allow, deny, or require human approval — and Kvlar enforces them deterministically. \nFail-closed: if no rule matches, the action is denied.

kvlar init --template postgres # curated policy (11 rules)\nkvlar wrap # inject proxy into Claude Desktop\nkvlar test -f policy.test.yaml # verify your policy in CI

What it catches today:

Postgres: blocks DROP TABLE, gates INSERT/UPDATE, allows SELECT\nGitHub: blocks repo creation, gates force-push and merges, allows reads\nSlack: gates message sending, allows channel reads\nShell: blocks rm -rf, sudo, curl|bash — gates installs, allows ls/cat/grep\nTechnical details:

Written in Rust (4 crates), pure policy engine with zero I/O\n100+ policy tests\nPolicy composition via extends — build on top of curated templates (docker compose style)\nWorks with Claude Desktop

Apache 2.0\nWebsite: https://kvlar.io\nInstall: cargo install kvlar-cli

I'd love feedback on the policy design and what MCP servers you'd want covered next.","url":"https://github.com/kvlar-io/kvlar","domain":"github.com","comments":[],"comments_count":0}