The firewall between your AI and its tools
EvilGum is a Layer-7 security gateway that sits between an AI agent and its MCP tool servers — inspecting every tool call and blocking rug-pulls, prompt injection, and data exfiltration before they ever reach your tools. Fail-closed.
An open-source MCP security gateway from Faseel’s product lineup.
Every tool call is inspected
Eight layers of defense
RBAC
Role-based access control over which agent may call which tool, scoped per identity.
Taint & information-flow control
Tracks tainted data end to end and stops it flowing into sinks it should never reach.
Rug-pull (schema-lock) detection
Locks each tool's schema and blocks silent redefinition — the classic MCP rug-pull.
Semantic WAF + DLP
Inspects tool-call content for prompt injection and sensitive data, then redacts or blocks it.
Macaroons
Capability tokens with caveats, so each call carries exactly the authority it needs — no more.
Asymmetric JWT + JWKS SSO
Verifies callers with asymmetric JWTs and JWKS-based SSO — no shared secrets to leak.
Tamper-evident audit log
Every verdict is written to a hash-chained log you can prove was never altered.
Fail-closed by design
If the gateway can't decide or anything is uncertain, the call is denied — never silently allowed.
Put a firewall in front of your AI agents
Open source, Apache-2.0, fail-closed. Deploy EvilGum between your agent and its MCP tools in minutes.
github.com/Iffi-crux/evilgum · part of faseel.app
