bastion

apatureai/bastion
★ 0 stars TypeScript Security Updated today
A remote MCP server for in-loop design review, and a worked reference for OAuth 2.1 auth, SSRF-safe URL handling, and long-running jobs over MCP.
View on GitHub → 🔍 Audit Wallet Slippage →

Quick Install

Copy the config for your editor. Some servers may need additional setup — check the README.

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "bastion": {
      "command": "npx",
      "args": [
        "-y",
        "apatureai/bastion"
      ]
    }
  }
}

README Excerpt

**A remote MCP server for in-loop design review, and a worked reference for OAuth 2.1 auth, SSRF-safe URL handling, and long-running jobs over MCP.** A coding agent changes a UI, deploys a preview, and has no way to see whether the result looks right. `bastion` is the MCP server on the other end of that loop: the agent submits a preview URL, gets back structured findings (route, viewport, element ref, suggested fix), applies the fixes itself, then asks the server to recheck them. The server judg

Tools (20)

BASTION_ALLOWED_HOSTSBASTION_ENGINECritiqueDATABASE_URLENGINE_BASE_URLENGINE_HMAC_SECRETMCP_ALLOWED_HOSTSMCP_AUTHORIZATION_SERVERSMCP_BODY_TIMEOUT_MSMCP_JWKS_URLMCP_MAX_BODY_BYTESMCP_MAX_IN_FLIGHT_PER_PRINCIPALMCP_PATHMCP_RESOURCE_URLMCP_TEST_DATABASE_URLMCP_TOKEN_ISSUERPORTVERDICT_CLIVERDICT_CONTEXT_DIRVERDICT_MODEL

Topics

mcpmcp-servermodel-context-protocoloauth2ssrf-protectiontypescript