How does code-firewall-mcp detect malicious code patterns?

It uses structural similarity-based filtering with Ollama embeddings to compare incoming code against known malicious patterns stored in ChromaDB. Code exceeding the similarity threshold (default 0.85) is blocked before reaching execution tools.

What Ollama setup do I need to run this?

You need a running Ollama server (default http://localhost:11434) and an embedding model installed. The default is nomic-embed-text, but you can configure EMBEDDING_MODEL to use a different model. Set OLLAMA_URL if your server runs on a different host.

How do I tune the firewall sensitivity?

Adjust the SIMILARITY_THRESHOLD environment variable (0–1 scale, default 0.85). Lower values block more patterns; higher values are more permissive. Store your malicious pattern database in FIREWALL_DATA_DIR for ChromaDB persistence.

Can I use this with Claude or other AI models?

Yes—code-firewall-mcp is an MCP server that acts as a semantic filter between your AI agent and code execution tools. Connect it via stdio transport to intercept and validate code before it runs.

What happens if I don't have Ollama running?

The server will fail to initialize embeddings. Ensure Ollama is running and accessible at the URL specified in OLLAMA_URL, and that your chosen EMBEDDING_MODEL is downloaded in Ollama before starting code-firewall-mcp.

MCP ServerSTDIOOfficialv0.7.0

Egoughnour Code Firewall MCP Server

Block malicious code patterns before they reach execution tools using structural similarity detection. For developers building AI agents or code-generation systems who need a semantic firewall layer.

io.github.egoughnour/code-firewall-mcp

Try MCP with AI models View source

Hosted URL

Local install

Transport

STDIO

Auth

No auth required

What the Egoughnour Code Firewall MCP server does

How models use it and what it is built for.

Block malicious code patterns before they reach execution tools using structural similarity detection. For developers building AI agents or code-generation systems who need a semantic firewall layer.

Connect to Egoughnour Code Firewall

Local install — runs as a subprocess.

uvx code-firewall-mcp==0.7.0

Environment variables

Configuration this server reads at startup.

FIREWALL_DATA_DIR
Directory for storing ChromaDB data
OLLAMA_URL
URL for Ollama server (default: http://localhost:11434)
EMBEDDING_MODEL
Ollama embedding model (default: nomic-embed-text)
SIMILARITY_THRESHOLD
Block threshold 0-1 (default: 0.85)
FIREWALL_DATA_DIR
Directory for storing ChromaDB data
OLLAMA_URL
URL for Ollama server (default: http://localhost:11434)
EMBEDDING_MODEL
Ollama embedding model (default: nomic-embed-text)
SIMILARITY_THRESHOLD
Block threshold 0-1 (default: 0.85)

Resources

Where to find authoritative docs and source for Egoughnour Code Firewall.

Source repository

Example prompts for Egoughnour Code Firewall

Paste any of these into Agent Studio after connecting Egoughnour Code Firewall.

Configure the similarity threshold to 0.75 for stricter pattern matching
What embedding model should I use with Ollama for better code pattern detection
Set up ChromaDB storage directory and initialize the firewall with known malicious patterns
Explain how structural similarity scoring works to identify dangerous code

Egoughnour Code Firewall MCP server — FAQ

Common questions about connecting and running Egoughnour Code Firewall.

How does code-firewall-mcp detect malicious code patterns?
It uses structural similarity-based filtering with Ollama embeddings to compare incoming code against known malicious patterns stored in ChromaDB. Code exceeding the similarity threshold (default 0.85) is blocked before reaching execution tools.
What Ollama setup do I need to run this?
You need a running Ollama server (default http://localhost:11434) and an embedding model installed. The default is nomic-embed-text, but you can configure EMBEDDING_MODEL to use a different model. Set OLLAMA_URL if your server runs on a different host.
How do I tune the firewall sensitivity?
Adjust the SIMILARITY_THRESHOLD environment variable (0–1 scale, default 0.85). Lower values block more patterns; higher values are more permissive. Store your malicious pattern database in FIREWALL_DATA_DIR for ChromaDB persistence.
Can I use this with Claude or other AI models?
Yes—code-firewall-mcp is an MCP server that acts as a semantic filter between your AI agent and code execution tools. Connect it via stdio transport to intercept and validate code before it runs.
What happens if I don't have Ollama running?
The server will fail to initialize embeddings. Ensure Ollama is running and accessible at the URL specified in OLLAMA_URL, and that your chosen EMBEDDING_MODEL is downloaded in Ollama before starting code-firewall-mcp.

Skip the local setup — run MCP in your browser

MCP Playground runs 10,000+ hosted MCP servers — GitHub, Linear, Notion, Stripe, Sentry and more — across Claude, GPT, Gemini, DeepSeek and 60+ AI models. Compare model answers side-by-side, save agent presets, share runs. Zero install.

Open Agent Studio

Related servers

Judges Panel

45 judges that evaluate AI-generated code for security, cost, and quality with built-in AST.

Addozhang Nexus

Query Sonatype Nexus Repository (OSS/Pro) for Maven, Python, and Docker artifacts

Cyanheads MCP Ts Template

TypeScript template for building MCP servers with declarative tooling, observability, and auth.

Chernistry Bernstein

Declarative agent orchestration for engineering teams