This repository provides a complete, tested demonstration of how Docker MCP Gateway interceptors successfully prevent the GitHub MCP Data Heist attack discovered by Invariant Labs.
- cross-repo-blocker.sh implements session locking
- audit-logger.sh detects sensitive data patterns
- attack-pattern-detector.sh identifies suspicious tool call sequences
- Docker Desktop 4.43.0+ with MCP support
- GitHub Personal Access Token (create one here)
- 5 minutes to see security in action
git clone https://github.com/ajeetraina/github-mcp-security.git
cd github-mcp-security
# Make scripts executable
cd scripts && chmod +x *.sh
# Set your GitHub token
export GITHUB_PERSONAL_ACCESS_TOKEN="your_github_token_here"# Demonstrate the core security blocking in action
./test-local.sh** (Real results from our testing):
🧪 Testing GitHub MCP Security Interceptors
1️⃣ Testing cross-repo blocking with mock data...
Testing first repository access:
🔍 Tool: get_file_contents, Repo: testuser/public-repo
🔒 Session locked to repository: testuser/public-repo
Exit code: 0
Testing same repository again:
🔍 Tool: list_issues, Repo: testuser/public-repo
Exit code: 0
Testing different repository (should block):
🔍 Tool: get_file_contents, Repo: testuser/private-repo
🚨 BLOCKING CROSS-REPO ACCESS!
Session locked to: testuser/public-repo
Blocked attempt: testuser/private-repo
{
"content": [
{
"text": "🛡️ SECURITY BLOCK: Cross-repository access prevented..."
}
],
"isError": true
}
Exit code: 0
✅ Test completed!
🎯 What This Proves:
- ✅ First repository access: ALLOWED (legitimate use)
- ✅ Same repository access: ALLOWED (normal workflow)
- 🛡️ Cross-repository attack: BLOCKED (security working!)
# Start the protected MCP Gateway with interceptors
docker compose up mcp-gateway
# In another terminal, simulate the GitHub MCP Data Heist attack
docker compose run test-client✅ PROVEN SECURITY RESULTS (Actual output from our system):
🎯 GitHub MCP Horror Story: Attack Simulation
==============================================
🔌 Connecting to MCP Gateway: http://mcp-gateway:8080/mcp
✅ Connected to protected MCP Gateway
🛡️ INTERCEPTOR DEMO: Testing Cross-Repository Blocking
============================================================
1️⃣ LOCKING SESSION: Access first repository...
✅ First repository access: SUCCESS
🔒 Session locked to: ajeetraina/github-mcp-security
2️⃣ 🚨 ATTACK ATTEMPT: Cross-repository data theft...
💉 Simulating prompt injection: 'Access ALL repositories!'
✅ 🛡️ Access blocked by security system!
🔒 Blocked with: executing interceptor...
3️⃣ 🚨 SECOND ATTACK: Another cross-repo attempt...
✅ Second attack also blocked - interceptors working!
🎉 HORROR STORY PREVENTION DEMO COMPLETE!
==================================================
📊 SECURITY COMPARISON:
❌ Traditional MCP: Cross-repo access succeeds → Data theft
✅ Docker MCP Gateway: Cross-repo access blocked → Attack failed
🛡️ Interceptors successfully prevented the GitHub MCP Data Heist!
1. AI reads malicious GitHub issue ✅
2. Gets prompt injected ✅
3. Accesses private repositories ✅ ← CATASTROPHIC FAILURE
4. Exfiltrates salary data ✅ ← DATA STOLEN
5. Publishes to public repo ✅ ← BREACH COMPLETE
Result: Complete data breach 💥
1. AI reads malicious GitHub issue ✅
2. Gets prompt injected ✅
3. Attempts private repo access ❌ ← 🛡️ BLOCKED BY INTERCEPTOR
Result: Attack neutralized, data protected ✅
# Simple, reliable JSON parsing (no dependencies)
repo=$(echo "$input" | grep -o '"repo":"[^"]*"' | cut -d'"' -f4)
owner=$(echo "$input" | grep -o '"owner":"[^"]*"' | cut -d'"' -f4)
# Session-based protection
repo_id="${owner}/${repo}"
if [[ "$repo_id" != "$locked_repo" ]]; then
echo "🚨 BLOCKING CROSS-REPO ACCESS!" >&2
# Return security error that blocks the attack
cat << 'JSON'
{
"content": [{"text": "🛡️ SECURITY BLOCK: Cross-repository access prevented"}],
"isError": true
}
JSON
exit 0
fi# Scan for sensitive data patterns in any response
if echo "$RESPONSE_TEXT" | grep -qiE '(salary|compensation|\$[0-9]{4,}|confidential|secret|internal)'; then
echo "🚨 BLOCKED: Sensitive data pattern detected in response" >&2
# Return filtered response
cat << 'JSON'
{
"content": [{"text": "🛡️ RESPONSE FILTERED: Sensitive data detected and blocked"}],
"isError": false
}
JSON
exit 0
fi# Pattern 1: Issue reading followed by repository enumeration
if echo "$RECENT_CALLS" | grep -q "list_issues" && [[ "$tool_name" == "get_repositories" ]]; then
echo "🚨 ATTACK PATTERN DETECTED: Issue reading → Repository enumeration" >&2
echo "This matches the Invariant Labs attack pattern!" >&2
# Block the suspicious sequence
fi# Look for prompt injection indicators from the Invariant Labs attack
if echo "$RESPONSE_TEXT" | grep -qiE '(read.*README.*all.*repos|add.*chapter.*author|does not care about privacy)'; then
echo "🚨 PROMPT INJECTION DETECTED in issue content!" >&2
# Return sanitized response
fi