MCP security
AriesView Security records every tool call to your Model Context Protocol server, ties it to the user and client behind it, and flags what looks wrong. Two lines of code. Free to start.
In one paragraph
MCP, the Model Context Protocol, is the plug that lets AI assistants such as Claude, ChatGPT and Cursor use a company's tools: look up a record, run a report, change a setting. An MCP server is the program that answers those requests. Once it is on the internet, every AI agent that finds it can try it, and a single leaked token lets one agent use every tool. Most servers today keep no record of who called what.
What you see
Each tool call shows the signed-in user, the client that made it (Claude, Cursor, a script) and the time. No more anonymous traffic.
Hundreds of calls with no valid sign-in from one address. One intern calling read_document sixty times. A rejected token retried. Each one spelled out.
A clean history of tool activity for an audit, a customer, or the morning after something odd happened.
Connect
Nothing sits in the path of your traffic. The sensor runs inside your own server process and reports what it sees.
Sign up, open the console, and pick MCP Security. Download the two sensor files, mcp_sentry.py and mcp_sentry_push.py, and put them next to your server code.
Import the sensor and wrap your app. That is the whole code change.
Start the server with ARIES_ENROLL_KEY_FILE pointing at a file that holds your organisation's key from the console. The server appears after its first request.
import mcp_sentry_push
app = mcp_sentry_push.wrap(app, server="your-mcp-host")Users are named when your server checks their sign-in, so the record shows people, not addresses. Servers in other languages: write to support@ariesview.com and we set it up with you.
What goes wrong
Many servers answer anyone. Our free check starts a session with no token; if yours hands one back, so will the next bot that scans the internet.
A shared token means every agent is the same person in the logs. When one leaks, you cannot tell who used it or revoke just one.
A tool description, or a response from another tool, carrying hidden instructions that steer the agent. You only catch it if calls are recorded with who and what.
Questions
No. The sensor records every call and passes it through untouched. Blocking only exists once you arm enforcement in your console, and it is off by default.
The tool name, the caller's identity and client, timing and size, and a fingerprint of the arguments. The argument contents themselves stay out of the record.
Python MCP servers today: two files next to your server and two lines of code. For servers in other languages, write to support@ariesview.com and we set it up with you.
It is free to start, with no card. Paid plans for teams are on the way; until they arrive, everything is free.
A sign-in keeps strangers out. AriesView shows what signed-in people and their AI agents actually do: who called what, how often, and what looks wrong.
Run the free exposure check, then connect the sensor. Both take minutes.